airdrop-arai[.]app

The domain airdrop-arai.app has been identified as a brand impersonation threat specifically designed to deceive users through a fraudulent ARAI Airdrop scheme. Analysis confirms this domain is currently offline, though it previously operated as an active scam targeting cryptocurrency holders. The threat type is classified as brand impersonation, with the scam mimicking legitimate airdrop promotions to lure victims into interacting with malicious infrastructure. Infrastructure analysis reveals the domain resolved to the IP address 104.21.48.1 and was flagged by 3 of 95 security vendors on VirusTotal. It appears on four distinct security blocklists, including entries from Polkadot, Codeesura, PhishDestroy, and Enkrypt. The page title associated with the domain was 'ARAI Airdrop,' reinforcing its fraudulent intent to impersonate a legitimate cryptocurrency distribution event. No registrar or creation date details were provided in available intelligence, but the domain's presence on multiple blocklists underscores its malicious classification. Current status indicates the domain has been taken offline, reducing immediate risk to end users. However, organizations and individuals are advised to maintain vigilance, as similar domains may emerge using comparable naming conventions. Network-level blocking of the IP 104.21.48.1 is recommended to prevent potential future resolutions. Users should verify airdrop legitimacy through official project channels and avoid interacting with domains lacking verifiable cryptographic signatures or endorsements from trusted sources.