pumpairdrop[.]xyz

This domain, pumpairdrop.xyz, is identified as a brand impersonation threat specifically targeting users through an airdrop scam. The domain is currently offline, but prior analysis confirms its malicious intent to deceive victims by mimicking legitimate cryptocurrency airdrop promotions. The specific brand impersonated in this campaign is not explicitly named but aligns with common airdrop fraud schemes observed in recent months. Analysis indicates that pumpairdrop.xyz was flagged by 3 of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect its recent deployment or evasion techniques. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolved to IP address 172.67.202.123, a Cloudflare-hosted endpoint, which is consistent with threat actors leveraging content delivery networks to obscure malicious activity. The domain appears on 2 security blocklists and is blocked by at least two independent detection systems. Additional technical indicators include the use of Cloudflare Browser Insights and HTTP/3, as well as an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. The page title, '404 Not Found,' suggests the domain was either hastily abandoned or intentionally configured to evade automated scanners. The current status of pumpairdrop.xyz is offline, reducing immediate risk to users. However, the infrastructure and registration details indicate a pattern consistent with transient phishing operations. Organizations and individuals are advised to proactively block the domain and its associated IP address (172.67.202.123) at the network perimeter. Security teams should monitor for related domains registered through the same registrar, particularly those created in close temporal proximity to this incident. End-users should be educated on the risks of airdrop scams, including the prevalence of brand impersonation and the use of seemingly legitimate SSL certificates to deceive targets. If interaction with this domain occurred prior to its takedown, affected parties should conduct a thorough review of connected accounts, particularly cryptocurrency wallets, for unauthorized transactions or credential exposure.