exabitsairdrop[.]xyz

The domain exabitsairdrop.xyz was registered on 14 October 2025 through Ultahost, Inc. and points to the IPv4 address 45.12.2.67, which is allocated to AS6698 Virtual Systems LLC in Ukraine. The site presented the page title “Exabits Airdrop – The Future of AI Compute” and employed the publicly identified “Airdrop Scam” phishing kit, targeting the brand “base” with a fake airdrop narrative. Scamadviser assigned a trust score of 1 out of 100, indicating extreme suspicion. No SSL certificate was observed, and the HTTP service has been taken offline at the time of analysis (status: offline).

The domain was configured with four name servers—ns1.adixairdrop.xyz, ns1.exabitsairdrop.xyz, ns2.adixairdrop.xyz, and ns2.exabitsairdro—suggesting an attempt to distribute resolution across multiple points, although the last entry appears truncated in the WHOIS data. VirusTotal scans show that seven of ninety‑five security vendors flagged the domain, and it appears on a single external blocklist. PhishDestroy has already added the domain to its blocklist. Evidence from these sources confirms that the infrastructure was used for a brand‑impersonation campaign delivering a counterfeit airdrop offer.

Because the site is currently offline, live content analysis is not possible, and the absence of an SSL certificate limits the ability to inspect encrypted traffic. Defenders should continue to block the domain name and its associated IP address, ingest the observed name‑server patterns into threat‑intel feeds, and monitor for re‑use of the “Airdrop Scam” kit against the “base” brand. Additional mitigation steps include updating web‑gateway and DNS‑filtering policies to drop queries for exabitsairdrop.xyz and any subdomains that resolve to the same IP range, and conducting periodic re‑scans of the IP block for potential re‑hosting of similar campaigns.