unstake[.]drafted[.]fun

The domain unstake.drafted.fun was registered on 31 March 2026 through NameCheap, Inc. and is currently hosted on the IP address 216.150.1.129, which resolves to a Vercel, Inc. infrastructure located in the United States. The site is reachable over HTTPS using a Let’s Encrypt R13 certificate, indicating a valid TLS configuration despite malicious intent.

Infrastructure analysis shows the domain uses the registrar‑provided nameservers dns1.registrar-servers.com and dns2.registrar-servers.com. Reputation services assign a Gridinsoft trust score of 0 out of 100, and the domain appears on one external security blocklist. VirusTotal reports that a single out of ninety‑five scanning engines flagged the host, confirming at least one detection of malicious content.

The public page title reads “Drafted Instant Unstake - Claim Your Airdrop,” and the page has been associated with an “Airdrop Scam” phishing kit. Classification aligns with a staking‑related crypto drainer operation, listed as a “Staking Scam” in the intelligence feed. The threat level is marked high, and the domain remains active despite being blocked by PhishDestroy.

Defenders should treat unstake.drafted.fun as a high‑risk indicator. Network controls ought to deny outbound connections to 216.150.1.129 and block DNS resolution for the domain. Email and web gateway filters should add the domain to deny lists, and SOC analysts should monitor for related campaign artifacts such as similar airdrop‑themed URLs or the same phishing kit fingerprint.