lgns[.]origindefitoken[.]world

The domain lgns.origindefitoken.world was registered through OwnRegistrar, Inc. on February 21, 2026 and remains active. DNS resolution points to the IPv4 address 103.224.182.245, which is hosted in the United States by Trellian Pty. Limited. Authoritative name servers are ns1.managedns1.com and ns2.managedns1.com.

The site presents a valid HTTPS certificate issued by Let’s Encrypt (YR2), and HTTP requests return a 200 OK status, indicating that a web server is actively serving content. Two of ninety‑three security engines on VirusTotal have flagged the domain as malicious, and both PhishDestroy and ScamSniffer list it as blocked; it also appears on two additional security blocklists, reinforcing its classification as a crypto‑draining scam. The only observed page title is “origindefitoken.world”, which provides no brand or service context. Analysis confirms the domain’s crypto scam designation, but no public samples of page content, scripts, or payload have been released, leaving the exact wallet‑draining technique uncertain.

The recent creation date and active status suggest a newly deployed infrastructure that may be part of an ongoing campaign. Defenders should block DNS resolution to 103.224.182.245, add the domain to URL filtering and web‑proxy deny lists, and monitor outbound traffic for connections to the host. Email gateways should flag any messages containing the domain or its subdomains. Continuous re‑scanning on VirusTotal and other sandbox services is recommended to capture any evolving malicious payloads.