airdrop[.]piratecrew[.]fun

The domain airdrop.piratecrew.fun is currently active and listed under the crypto_drainer threat type. It was registered on May 25, 2025 through NameCheap, Inc. and is flagged as under_investigation. The site returns HTTP 200 responses and presents the page title “Pirate Airdrops”, indicating the campaign is positioned as a cryptocurrency airdrop offering. Infrastructure analysis shows the domain resolves to IP address 216.150.1.1, which belongs to AS16509 Amazon.com, Inc. located in the United States. The hosting provider is identified as Vercel, and the domain is served over a valid Let's Encrypt R12 certificate with HSTS enabled. Nameservers are magnolia.ns.cloudflare.com and stanley.ns.cloudflare.com, suggesting Cloudflare DNS is in use. Threat intelligence reports associate the site with the “Airdrop Scam” phishing kit, a known cryptocurrency drainer that typically lures victims into submitting wallet credentials. The site appears on a single security blocklist, specifically PhishDestroy, and has a Gridinsoft trust score of 0/100. No detections were recorded on VirusTotal (0/95), but that metric alone does not confirm safety. Defenders should add airdrop.piratecrew.fun to blocklists at network and endpoint layers, and consider sinkholing the associated IP range if feasible. Continuous monitoring of DNS queries for the domain and its Cloudflare nameservers is recommended. Because the site’s content has not been publicly analyzed, further HTTP response inspection is advised to confirm the presence of credential‑harvesting forms and to collect additional IOCs.