www3-vpass[.]wzjnzdm[.]com

Analysis indicates that www3-vpass.wzjnzdm.com is an active phishing domain associated with an Airdrop scam. The domain resolves to IP address 104.21.36.89, hosted on Cloudflare infrastructure (AS13335) in the United States. As of July 12, 2026, the domain remains operational, returning an HTTP 200 status despite displaying a '502: Bad gateway' page title, which may indicate a misconfigured or intentionally obscured phishing backend. Infrastructure review shows the domain was registered on October 28, 2016, through Gname.com Pte. Ltd., with Cloudflare nameservers (gina.ns.cloudflare.com and rex.ns.cloudflare.com). No SSL certificate is present, increasing the risk of unencrypted credential harvesting. Google Safe Browsing has flagged the domain for social engineering, and it appears on at least one security blocklist. Eleven of 95 security vendors on VirusTotal detect the domain as malicious, though the exact nature of the threat remains partially unverified due to limited public telemetry. The domain is classified as an Airdrop scam, suggesting it likely targets cryptocurrency users with fraudulent token giveaway schemes. Defenders should treat this domain as high-risk and consider blocking it at the DNS or network level. Further investigation into associated IP ranges and registration patterns may reveal additional linked infrastructure. The exact content of the phishing pages is not yet analysed, but the combination of technical indicators and known scam classification warrants immediate mitigation.