grandmacoin[.]net

Analysis of grandmacoin.net shows a short‑lived infrastructure used to host a fake airdrop campaign that references a Minecraft‑themed "Grandma Fund" in its page title. The domain was registered on 15 January 2026 through NiceNIC International Group Co., Limited and is served from Cloudflare’s network (AS13335) at IP 172.67.201.246, a U.S. location. DNS resolution uses Cloudflare‑provided nameservers DECKER.NS.CLOUDFLARE.COM and SLOAN.NS.CLOUDFLARE.COM, and the site advertised HSTS and HTTP/3 support. SSL termination is performed by Google Trust Services under the WE1 certificate, indicating a valid TLS certificate despite the malicious intent.

HTTP requests returned a 403 status before the site was taken offline, and the domain currently resolves to an inactive endpoint. Security vendors have flagged the domain in 16 of 93 VirusTotal scans, and it appears on two commercial blocklists, specifically PhishDestroy and ScamSniffer. AlienVault OTX lists the domain in a single threat‑intel pulse, reinforcing its classification as a fake‑airdrop scam. The observed page title "Minecraft Grandma Fund | AirDrop" aligns with the known phishing kit identified as an "Airdrop Scam" template, suggesting the operators are leveraging popular gaming terminology to lure victims.

Defenders should block the domain at DNS and proxy layers, monitor outbound connections to the associated Cloudflare IP, and update intrusion‑detection signatures to include the observed page title and SSL fingerprint. Since the site is offline, threat actors may redeploy the same kit under a new domain; continuous monitoring of newly registered domains using the NiceNIC registrar and rapid scanning of Cloudflare‑hosted IP ranges can reduce exposure. Uncertainty remains regarding the full payload delivered to victims, as the landing page content has not been captured; threat‑intel teams should seek archived copies or request forensic snapshots from security vendors that performed the initial scans.