babyairdrop[.]me

The domain babyairdrop.me was registered on August 12, 2025 through Gandi SAS and currently resolves to the IP address 172.67.75.51, which is hosted by Cloudflare (AS13335) in the United States. The site returns HTTP 200 responses but does not present an SSL certificate, indicating a lack of transport encryption. The page title observed reads "Pell Restake App | Restake Bitcoin (BTC) - Secure Your Bitcoin Restaking With Pell," and the listed scam type is a crypto scam that impersonates Bitcoin. VirusTotal analysis shows that 10 of 95 security vendors have flagged the domain, and the domain appears on four public blocklists. Additional reputation data include a Gridinsoft trust score of 0/100, a Scamadviser score of 45/100, and blocking by PhishDestroy, Polkadot, Enkrypt, and Codeesura. Nameservers aisha.ns.cloudflare.com and norman.ns.cloudflare.com confirm Cloudflare DNS usage. While the page title and vendor flags strongly suggest a malicious Bitcoin‑related impersonation campaign, the internal page content has not been publicly disclosed, leaving the exact phishing mechanics uncertain. Defenders should add babyairdrop.me to deny‑list rules at network perimeters, monitor DNS queries for the domain, and enforce TLS inspection where possible to detect any future payload delivery. Continuous threat‑intel feeds should be consulted for updates, and any user reports of unsolicited Bitcoin‑restaking offers should be escalated for investigation.