airdrop-agent[.]xyz

Airdrop-agent.xyz is an active scam domain impersonating an airdrop operation. Despite its cloaking tactics, it has been flagged by 2 of 91 vendors on VirusTotal and appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. The domain is registered through GMO Internet, Inc., hosted on an Amazon IP in the US, and uses an SSL certificate issued by GoDaddy.com.

The domain's cloaking score of 2 out of 10 indicates it serves benign content to scanners, a common tactic to evade detection. This approach allows the site to remain active and potentially deceive users into participating in fraudulent airdrop schemes. The platform risk score is a perfect 100, highlighting the severe threat it poses, while the abuse score is 23, suggesting some level of malicious activity has been recognized.

The rapid detection of airdrop-agent.xyz by PhishDestroy just two days after its creation underscores the effectiveness of early threat identification. This domain exemplifies how phishing sites exploit the time gap between domain registration and antivirus database updates, often remaining undetected by many security vendors during this window. The presence of this domain on multiple blocklists further validates the threat it poses to users who might be lured by the promise of free cryptocurrency through fake airdrop offers.