boredapeyacht[.]xyz

The domain boredapeyacht.xyz was registered through NiceNIC International Group Co., Limited on 21 February 2026. DNS resolution is delegated to Cloudflare nameservers gigi.ns.cloudflare.com and kayden.ns.cloudflare.com, and the domain resolves to the Cloudflare edge address 172.67.170.218, which belongs to ASN 13335 (Cloudflare, Inc.) in the United States. The site presented a page titled “Bored Ape Yacht Club Claim & Mint – BAYC Free Mint Portal”, which aligns with a fake airdrop campaign targeting holders of the Bored Ape Yacht Club collection. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint.

VirusTotal scans show that three of ninety‑three security vendors flagged the domain as malicious. Independent threat‑intelligence feeds list the domain on three blocklists, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL. The overall risk rating is elevated, and the campaign is categorized as a generic phishing operation delivering a fake airdrop. At the time of analysis the site was taken offline, and no live HTTP response could be captured.

Consequently, the exact content, credential‑harvesting mechanisms, or any additional malicious payloads remain unverified. The available evidence—registration details, Cloudflare hosting, the deceptive page title, vendor detections, and blocklist listings—provides sufficient confidence to treat the domain as a malicious phishing vector. Defenders should proactively block the domain and its associated IP address at network perimeters, add the domain to URL filtering and anti‑phishing policies, and monitor for any future resurrection of the host under different subdomains or IPs. Continuous re‑scanning with multi‑engine services is advised to capture any changes in detection status.