gomdori-airdrop[.]xyz

The domain gomdori-airdrop.xyz was registered on 21 February 2026 and is currently listed as offline. Automated reputation services have assigned it a Gridinsoft trust score of 0 out of 100, indicating a complete lack of confidence in its legitimacy. VirusTotal analysis shows that four of ninety‑three scanned security vendors flagged the domain as malicious, which aligns with its classification as a crypto‑drainer type scam.

The site appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering system. The TLS certificate presented for the domain is identified as “WE1”, a characteristic often observed in low‑cost or self‑signed certificates used by malicious operators. The only visible page title returned by the HTTP response is “Just a moment…”, offering no functional content and suggesting the site may have been taken down or is serving a placeholder page.

The combination of a recent creation date, zero trust score, multiple vendor detections, blocklist inclusion, and a generic placeholder title provides a consistent picture of a domain employed to lure victims into cryptocurrency‑related fraud. Defenders should continue to enforce blocks on gomdori-airdrop.xyz across network perimeter and endpoint controls, monitor for any residual traffic or DNS queries, and consider adding the domain to internal threat‑intel feeds. Ongoing observation of related indicator sets, such as any IP addresses or certificate fingerprints that may be reused, is recommended to capture potential re‑deployment of the campaign.