airdrop[.]dagama[.]world

Analysis indicates that airdrop.dagama.world is an active malicious site targeting users of the Arbitrum blockchain through a brand‑impersonation campaign labeled as an “Airdrop Scam”. The domain resolves to 34.141.144.59, an address located in the Netherlands and assigned to AS396982 (Google LLC). The site presents a valid TLS certificate issued by Let’s Encrypt (R13) and returns HTTP 200, which may aid credibility. Infrastructure fingerprints show an Ubuntu operating system behind an Nginx web server, with client‑side libraries including SweetAlert2, jQuery, Google Tag Manager, Google Hosted Libraries, Google Font API, and Google Analytics. The page title “Main AirDrop” aligns with the phishing kit identified as “Airdrop Scam”. The domain is listed on one public blocklist and is blocked by PhishDestroy. Reputation services assign a Gridinsoft trust score of 0/100, and four of ninety‑five VirusTotal scanners flagged the host. Nameservers are distributed across ns1qsy.name.com, ns2nsy.name.com, ns3qty.name.com, and ns4kmw.name.com, all registered via Name.com, Inc. Current intelligence does not reveal any additional payloads or credential‑harvesting forms; the exact content of the landing page remains unverified. Defenders should block DNS resolution for the domain and its authoritative name servers, monitor outbound connections to the associated IP, and update intrusion detection signatures to detect traffic to the listed web technologies. Continuous re‑assessment is advised in case the infrastructure evolves or additional detections appear.