commonlabs[.]xyz

Analysis of the domain commonlabs.xyz, created on February 21, 2026 and registered through Name.com, Inc., shows a clear association with a fake airdrop phishing campaign. The public page title reads "Common | Airdrop," which aligns with the identified scam type "Fake Airdrop" and the observed phishing kit labeled "Airdrop Scam." The domain resolves to the IP address 87.120.107.110, which is registered to AS215428 Mykyta Skorobohatko in Finland. Four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—have added the domain to their deny lists, indicating that multiple security services consider the host malicious.

VirusTotal records show that two of ninety‑three security vendors flagged the domain, providing additional corroboration of suspicious activity. The authoritative nameservers listed for the zone are ns1crv.name.com, ns2dqr.name.com, ns3gxy.name.com, and ns4cfn.name.com, a pattern often seen in disposable or fast‑flux infrastructures used by phishing operators. No SSL certificate was observed for the site, and the current operational status is recorded as offline, suggesting that the infrastructure may have been taken down or is intermittently active.

While the available data confirms the domain’s involvement in a fake airdrop scheme, the exact content of the site, user interaction flows, and any credential harvesting mechanisms have not been publicly captured, leaving those specifics uncertain. Defenders should continue to block the domain at perimeter firewalls and proxy solutions, monitor DNS queries for the listed nameservers, and consider adding the IP address 87.120.107.110 to threat‑intel feeds. Ongoing telemetry collection from endpoint agents and web proxies is recommended to detect any residual attempts to reach the infrastructure, especially given the elevated risk rating associated with this campaign.