audius-check[.]co

The domain audius-check.co was registered on 12 March 2026 through NiceNIC International Group Co., Limited and resolved to the Cloudflare address 104.21.12.61, which is located in the United States under ASN 13335. The authoritative name servers are harlan.ns.cloudflare.com and nena.ns.cloudflare.com, indicating the use of Cloudflare’s CDN and DNS services. No TLS certificate is presented for the site, meaning traffic is served without encryption. Static analysis identified a page title of “Airdrop 3 Artists | Audius”, and the underlying infrastructure includes Plesk, PHP, Cloudflare Browser Insights, and HTTP/3 support.

The site is associated with the publicly known “Airdrop Scam” phishing kit and is classified as a crypto‑related scam. Security scanners have flagged the domain: four of ninety‑five VirusTotal engines reported malicious behavior, and the Gridinsoft trust score rates it at 0 / 100. The domain appears on two external blocklists and has been listed by PhishDestroy and ScamSniffer. Current network status shows the site taken offline, but historical observations confirm the malicious activity.

Defenders should immediately block the domain at perimeter firewalls and proxy devices, ingest the IP 104.21.12.61 into threat‑intel feeds, and monitor for any rapid re‑hosting on other Cloudflare‑backed addresses. Because the kit leverages a generic “Airdrop” lure, it is advisable to create detection rules that look for similar page titles or content patterns, and to alert on new domains that resolve to the same Cloudflare ASN within a short window after registration. Ongoing telemetry should be collected to verify whether the infrastructure resurfaces under alternative domains, and any related indicators should be shared with industry‑wide blocklist services.