deagentai[.]info

The domain deagentai.info was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is currently active. DNS resolution points to 172.67.192.243, an address owned by AS13335 Cloudflare, Inc., located in the United States. The site is served behind Cloudflare, employing HTTP/3 and presenting a Google Trust Services / WE1 SSL certificate, a common configuration for Cloudflare‑protected sites. An HTTP 525 response indicates that the origin server failed to establish a proper TLS handshake, which is consistent with misconfigured or intentionally concealed back‑end infrastructure.

VirusTotal analysis shows that 3 of 93 security vendors have flagged the domain, providing a modest but notable detection signal. Independent phishing blocklists, including PhishDestroy and ScamSniffer, have listed deagentai.info, and the domain appears on two additional blocklists, reinforcing its malicious reputation. The page title observed, "DeAgentAI $AIA Airdrop," and the identified phishing kit labelled “Airdrop Scam” align with a crypto‑focused social engineering campaign. The scam type is recorded as a Crypto Scam, suggesting attackers are likely attempting to lure victims with fraudulent token airdrop promises.

While the page title and kit classification provide concrete indicators of a crypto‑airdrop phishing operation, the actual page content has not been captured, leaving the precise lure and credential‑harvesting mechanisms uncertain. Defenders should treat the domain as high‑risk: block DNS resolution, add the IP to network‑level deny lists, and monitor for any outbound connections to the Cloudflare address. Continuous re‑scanning of the site and correlation with endpoint telemetry are advised to detect potential victim interaction.