airdrop[.]fabricfoundation[.]lat

Analysis of the domain airdrop.fabricfoundation.lat indicates it was actively associated with a crypto drainer scam, as classified by security vendors. The domain was registered on February 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently offline. Infrastructure analysis reveals Cloudflare-hosted nameservers (audrey.ns.cloudflare.com and rohin.ns.cloudflare.com) resolving to the IP address 172.67.132.155, which is part of AS13335 (Cloudflare, Inc.) in the United States. No SSL certificate was detected, and the only observable page title was 'Just a moment...', which aligns with Cloudflare interstitial pages but provides no further content evidence.

The domain appears on one security blocklist (PhishDestroy) and has a Gridinsoft trust score of 0/100, reflecting high-risk classification. VirusTotal data shows a single detection flag from 93 security vendors, though the absence of broader scanning results limits confidence in this metric. The scam type is explicitly labeled as a 'Crypto Scam' in available intelligence, though specific tactics or targeted platforms remain unconfirmed. Defenders should treat this domain as compromised infrastructure.

The Cloudflare-hosted nature of the domain, combined with its offline status, suggests potential evasion tactics or takedown efforts. Network-level blocking of the resolved IP (172.67.132.155) and monitoring for re-registration or DNS changes are recommended. Given the crypto drainer classification, wallet addresses or transaction patterns linked to this domain should be cross-referenced with blockchain analysis tools for further evidence of fraudulent activity. The lack of SSL and minimal page content suggests the domain may have been part of a larger, automated campaign rather than a standalone phishing site.