onchainairdrop[.]xyz

Analysis of the domain onchainairdrop.xyz indicates it is an active crypto-draining scam targeting users through a fake airdrop scheme. Registered on June 12, 2026, via GMO Internet Group, Inc. d/b/a Onamae.com, the domain resolves to IP 76.223.54.146, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The domain is flagged by three security blocklists and appears in one AlienVault OTX threat intelligence pulse, with a Gridinsoft trust score of 0/100. Five of 91 security vendors on VirusTotal detect the domain as malicious. SSL certification is provided by GoDaddy.com, and the site employs technologies including Node.js, Express, and Akamai Web Application Protector, which may complicate detection or takedown efforts. The domain is currently blocked by PhishDestroy, MetaMask, and SEAL, suggesting its association with known malicious activity. While the exact content of the site has not been analyzed, its classification as a 'Fake Airdrop' scam aligns with common crypto-draining tactics, where users are tricked into connecting wallets to claim non-existent tokens, resulting in unauthorized fund transfers. Defenders should treat this domain as high-risk and prioritize blocking it at the DNS or network level. Given its recent registration and active status, monitoring for related domains or IP shifts is recommended, as threat actors often rotate infrastructure to evade detection.