l2rew[.]top

Analysis as of July 24 2026 confirms that the domain l2rew.top is being used for an Airdrop Scam phishing operation. The domain was registered on December 14 2025 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare infrastructure (AS13335, United States). DNS resolution points to the IP address 104.21.57.29, which is served by Cloudflare and supports HTTP/3. The authoritative nameservers are milan.ns.cloudflare.com and nancy.ns.cloudflare.com, indicating full proxying by Cloudflare's edge network. The TLS certificate presented is issued by Google Trust Services under the WE1 intermediate, a typical Cloudflare‑provided certificate that confirms the use of Cloudflare SSL but does not mitigate the malicious intent.

An HTTP 301 redirect is observed and the final page title returned is "522: Connection timed out", suggesting the backend origin is currently unavailable or the site is deliberately serving an error page to hinder content retrieval. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a phishing source. VirusTotal has flagged the domain in 3 of 95 scanned security vendors, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating, reflecting high confidence of malicious activity.

The operation uses the publicly known Airdrop Scam phishing kit, which typically lures victims with promises of cryptocurrency airdrops. No additional intelligence such as Safe Browsing or Open Threat Exchange entries is currently available, and the actual landing content could not be retrieved due to the 522 timeout. Defenders should block l2rew.top at DNS and proxy layers, add the IP 104.21.57.29 to deny lists, and monitor for related traffic. Continued sandbox scanning is advised if the site becomes reachable, and any observed credential or token submissions should be investigated as potential compromise.