airdropsalerts[.]vip

Analysis conducted on July 24, 2026 identifies airdropsalerts.vip as an active crypto‑drainer infrastructure that has been taken offline but remains listed on multiple threat intelligence sources. The domain was registered on November 13, 2025 through Dynadot LLC and is delegated to the Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com. DNS resolution points to the IPv6 address 2a06:98c1:3120::3, which belongs to AS13335 Cloudflare, Inc., and is geolocated to the United States. The site presents the page title “Access denied | airdropsalerts.vip used Cloudflare to restrict access | airdropsalerts.vip | Cloudflare”, indicating that Cloudflare is being used to block direct traffic, a common tactic for evasive phishing or scam sites. No SSL certificate was observed, meaning the site served only HTTP content before being shut down.

Threat intelligence shows the domain appears on four independent blocklists, specifically PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal scans recorded eight positive detections out of ninety‑five security vendors, reinforcing the malicious classification. The associated phishing kit is identified as the “Airdrop Scam” kit, which is frequently employed to lure cryptocurrency users into submitting private keys or sending funds to attacker‑controlled wallets. The overall risk level is elevated, consistent with the crypto‑drainer label assigned by the reporting system.

Defenders should continue to block airdropsalerts.vip at the DNS and proxy layers, ensure any residual traffic is redirected to a sinkhole for forensic capture, and add the IPv6 address to network‑wide deny lists. Monitoring for newly registered domains that reuse the same Cloudflare nameservers or exhibit similar page‑title patterns can help detect future iterations. Because the domain is currently offline, active takedown actions are not required, but continuous observation is advised to capture any re‑deployment attempts.