3113161452[.]xyz

Analysis of 3113161452.xyz shows a short‑lived crypto‑airdrop phishing infrastructure that was taken offline prior to the report date of 23 July 2026. The domain was registered on 21 February 2026 through Ultahost, Inc., and resolves to the IPv4 address 85.158.57.2, which belongs to AS212238 Datacamp Limited in Poland. All four authoritative name servers (ns1‑ns4.ultahost.com) are hosted by the same provider, and the TLS certificate presented is cp15.waw1.ultacp.com, indicating use of the provider’s default SSL. The site’s only observed content is the page title “CAMP Airdrop”, matching the “Airdrop Scam” phishing kit and the classified scam type of a crypto scam.

Gridinsoft assigned a trust score of 0 / 100, reflecting extreme maliciousness. VirusTotal records show that 12 of 93 scanned security vendors flagged the domain, confirming malicious classification. The domain appears on five external blocklists and has been actively blocked by the security services PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura. The combination of a low trust score, multiple vendor detections, blocklist listings, and the use of a known airdrop phishing kit indicates a high‑risk threat.

Defenders should ensure that any outbound connections to 85.158.57.2 are denied, add the domain and its associated IP to local blocklists, and monitor for any re‑registration attempts using the same registrar or name‑server pattern. Because the site is currently offline, threat hunting can focus on residual artifacts such as phishing emails that reference the “CAMP Airdrop” title or the Airdrop Scam kit, and on any credential‑stealing payloads that may have been delivered before takedown. Continuous observation of the Ultahost, Inc. registrar for new domains employing similar naming conventions is recommended to pre‑empt future campaigns.