airdrop[.]dege-token[.]fun

Analysis of airdrop.dege-token.fun, a domain created on February 21, 2026 and registered through NameSilo, LLC, indicates active infrastructure associated with a crypto drainer operation. The domain resolves to IP address 172.237.129.242, which is owned by Akamai Technologies, Inc. in the United States, and serves content over HTTPS using a Let’s Encrypt certificate (identifier YE1). HTTP requests receive a 200 response and the sole observable page title is "Redirecting...", suggesting a potential intermediary step before delivering malicious payloads.

Nameservers are ns1.ns306.parklogic.com and ns2.ns306.parklogic.com, typical of parking services, and the domain is presently listed on one security blocklist and has been blocked by PhishDestroy. VirusTotal reports that the domain was scanned by 93 vendors without any detections; however, the absence of detections does not constitute validation of safety. The available intelligence does not disclose specific payloads, command‑and‑control endpoints, or the exact mechanics of the crypto draining scheme, leaving the operational details uncertain.

Defenders should continue to monitor DNS resolutions to the Akamai‑hosted IP, enforce blocking of the domain at perimeter and endpoint security layers, and consider adding the domain to internal blocklists. Network traffic to the IP should be investigated for anomalous cryptocurrency transaction attempts or unauthorized wallet interactions. Given the active status and the classification as a crypto drainer, organizations handling cryptocurrency assets should treat any interaction with the domain as hostile and investigate related logs for potential compromise.