airdrop-claims[.]fun

This domain, airdrop-claims.fun, is identified as a brand impersonation threat designed to deceive users into engaging with fraudulent airdrop schemes. Analysis indicates the site mimics legitimate token distribution pages, using the page title 'TOKEN_NAME | Airdrop' to lure victims into connecting wallets or submitting sensitive information. No specific drainer kit signatures were confirmed, but the domain aligns with known airdrop scam patterns targeting cryptocurrency holders. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3 and is currently flagged by 2 out of 95 security vendors on VirusTotal. The domain appears on four security blocklists, including detections by MetaMask, ScamSniffer, SEAL, and PhishDestroy. No Google Safe Browsing (GSB) entries were reported at the time of analysis. The domain has since been taken offline, reducing immediate risk to users. However, residual threats persist, as similar infrastructure may be reused or repurposed for future campaigns. Users are advised to verify airdrop legitimacy through official project channels and avoid interacting with domains registered through high-risk registrars or exhibiting low VirusTotal detection rates. Monitoring for re-emergence of this domain or related variants is recommended.