rewards[.]banana-guy[.]fun

On 21 February 2026 the domain rewards.banana-guy.fun was registered. The site’s HTML title reads “BananaGuy Coin 🍌”, indicating an attempt to lure cryptocurrency‑interested users with a purported airdrop. The domain appears on a single security blocklist and is actively blocked by the PhishDestroy service. An SSL certificate identified as R13 is present, but the HTTPS endpoint currently returns no content because the site has been taken offline.

VirusTotal records show that the domain was submitted to 93 scanning engines, none of which raised a detection at the time of analysis. The limited evidence points to a “Fake Airdrop” scam, a common social‑engineering technique that promises free tokens in exchange for credential submission or wallet access. No additional infrastructure details such as hosting IP, ASN, or registrar are provided, and no safe‑browsing or OTX entries have been observed. Because the site is offline, active probing is not possible, leaving uncertainty around the full payload and any associated command‑and‑control infrastructure.

Defenders should continue to monitor the domain for re‑appearance, add it to internal blocklists, and ensure that any user‑facing services that reference “BananaGuy Coin” or similar airdrop promises are flagged for review. Network traffic to the domain’s IP range should be logged and, if observed, terminated. Security teams are advised to educate users about unsolicited airdrop offers and to verify the legitimacy of cryptocurrency promotions through official channels.