airdrop-solaxy[.]org

The domain airdrop-solaxy.org is currently flagged as an active cryptocurrency airdrop scam, targeting users with fraudulent token distribution schemes. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain resolves to the IP address 172.67.223.196, which is hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (ignacio.ns.cloudflare.com and liberty.ns.cloudflare.com) and HTTP/3, a configuration commonly observed in phishing operations due to its ability to obscure origin servers and evade detection. Access attempts to the domain return an HTTP 403 status with the page title 'Just a moment...', a response often associated with Cloudflare's anti-bot measures or intermediary gateways. While this may indicate an attempt to restrict access to only targeted victims, it does not rule out malicious intent. The domain is listed on at least one security blocklist, specifically PhishDestroy, and has been assigned a trust score of 0/100 by Gridinsoft, further corroborating its classification as high-risk. Five out of ninety-five security vendors on VirusTotal have flagged the domain, though the absence of broader detection does not imply safety. The domain impersonates cryptocurrency airdrop campaigns, a tactic frequently employed to deceive users into connecting wallets or divulging private keys under the guise of token rewards. The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate the legitimacy of the underlying operation. Defenders should treat this domain as malicious and prioritize blocking it at the DNS or network level, particularly in environments where cryptocurrency-related activities are common. Monitoring for related infrastructure, such as newly registered domains with similar naming patterns or shared hosting providers, may help identify additional threats in this campaign.