airdrop[.]cyberkongz[.]world

airdrop.cyberkongz.world is currently flagged as a crypto drainer under investigation. The site returns HTTP 403 and presents the page title “Just a moment…”. DNS resolution points to 104.21.32.1, which belongs to Cloudflare’s network (AS13335) located in the United States. The domain uses Cloudflare’s DNS service with nameservers peter.ns.cloudflare.com and anita.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 identifier. Registration information shows the registrar Web Commerce Communications Limited dba WebNic.cc. Automated analysis detected Cloudflare Browser Insights, Cloudflare, and HTTP/3 in the response headers. The domain appears on one security blocklist and is listed as blocked by PhishDestroy. VirusTotal records indicate the domain has been scanned by 95 vendors without any detections, but lack of detections does not imply the absence of malicious activity. The threat classification as a crypto drainer stems from the provided intelligence, although no payload or transaction details have been observed. Uncertainty remains regarding the specific mechanisms used to drain cryptocurrency, the hosting of any malicious scripts, and any victim interaction patterns. Defenders should block network traffic to 104.21.32.1 and add airdrop.cyberkongz.world to URL filtering and host-based deny lists. Continuous monitoring of DNS queries, TLS certificate changes, and any new blocklist listings is recommended. Incident response teams should treat any user‑initiated connections to this domain as potentially malicious and investigate associated logs for credential or wallet address exposure.