oggycoin[.]fun

The domain oggycoin.fun was registered on 21 February 2026 through the HOSTINGER operations, UAB registrar. DNS resolution points to the IP address 75.2.60.5, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The domain uses the generic parking nameservers ns1.dns-parking.com and ns2.dns-parking.com and does not present an SSL/TLS certificate, indicating that any HTTP connections would be unencrypted. The page title returned during the brief crawl was "Oggy – Animated Meme Coin on Solana", and the site is classified as a crypto‑scam that impersonates the Solana brand. The threat was first identified by PhishDestroy and is currently listed on one external blocklist.

VirusTotal analysis shows that two of ninety‑three security vendors flagged the domain, providing independent confirmation of malicious intent. No additional payloads, scripts, or redirection chains have been observed because the site is presently taken offline. Infrastructure analysis suggests the operators leveraged inexpensive domain registration and Amazon hosting to quickly launch a brand‑impersonation campaign. The absence of HTTPS and the use of parking nameservers reduce the credibility of the site and make it easier for threat actors to abandon the infrastructure once flagged.

Because the domain is already offline, immediate remediation focuses on blocking any residual DNS resolution and informing users who may have previously accessed the address. Defenders should add oggycoin.fun to network‑level deny lists, enforce DNS sink‑holing for the associated IP range, and monitor for future registrations that reuse the same registrar or nameserver pattern. Continuous surveillance of the AS16509 block for new domains presenting similar page titles or Solana‑related keywords is recommended to pre‑empt repeat attempts. Continuous threat‑intel sharing with brand protection teams is advised.