claim[.]coin-airdrops[.]com

The domain claim.coin-airdrops.com was registered on February 21, 2026. Analysis shows it is being used to impersonate the Chainlink brand, presenting itself under the generic page title “Coin‑Airdrops”. VirusTotal has recorded detections from 2 of 93 scanned security vendors, indicating that some AV engines recognize malicious behavior. Independent trust‑rating services assign very low reputations: Gridinsoft scores the domain 0 out of 100, while Scamadviser reports a 30‑point score. The TLS certificate is issued with an R13 rating, which falls below industry standards for certificate strength.

The site is classified as a “Crypto Scam” and uses the publicly known “Airdrop Scam” phishing kit. It has been placed on a single security blocklist and is currently listed as taken offline by PhishDestroy. The domain appears on one blocklist, confirming that at least one mitigation provider is actively blocking traffic to it. The available data does not reveal the hosting IP, autonomous system number, or registrar details, and no additional intelligence such as OTX tags or Safe Browsing alerts has been disclosed.

Consequently, the full infrastructure footprint remains partially unknown. Defenders should update URL filtering rules to include claim.coin-airdrops.com, enforce blocklist entries for the domain, and monitor for any related C‑2 infrastructure that may share the same hosting provider. Endpoint protection products should be configured to flag the two VirusTotal detections, and network teams should treat any outbound connections to the domain as malicious. Continuous re‑evaluation is advised in case the domain is re‑registered or the phishing kit is re‑deployed.