refundairdrop[.]top

refundairdrop.top is a malicious domain flagged for brand impersonation, specifically targeting users of cryptocurrency airdrop schemes. The threat type is brand impersonation, and the domain masquerades as an Airdrop Scam lure, likely employing a phishing or wallet-drainer kit to harvest credentials or private keys. The page title observed was Just a moment..., a common placeholder used during redirection or anti-bot checks, often preceding credential theft or social engineering prompts.

Technical indicators confirm the domain's malicious nature. VirusTotal detected it with 4 out of 95 security vendors, and the domain appears on 2 security blocklists. It was registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. The domain resolves to IP address 172.67.146.227, hosted on Cloudflare infrastructure, which provides DDoS protection and IP obscuration. The domain was created on August 18, 2025, making it very recent at the time of analysis. Gridinsoft assigned a trust score of 0/100, indicating high risk. The domain is not listed on Google Safe Browsing (GSB) based on the data provided.

Currently, refundairdrop.top is offline, with its status indicating taken offline. It has been blocked by PhishDestroy and ScamSniffer, two community-driven blocklists. While the domain is no longer resolving, residual risk remains if the same operators register similar domains under different names. Users who may have visited the site should monitor for unauthorized transactions and avoid interacting with any unsolicited airdrop offers. General safety guidance includes verifying airdrop URLs through official project channels, never connecting wallets to unknown sites, and using hardware wallets for high-value assets.