airdrop[.]defiapp[.]cfd

Analysis of the domain airdrop.defiapp.cfd indicates it was actively used for wallet and seed-phishing operations targeting Apple users. The domain was registered on February 21, 2026, through Web Commerce Communications Limited (WebNic.cc) and resolved to 188.114.97.3, an IP address hosted on Cloudflare's network (AS13335) in the United States. Nameservers ns100.webnic.cc and ns101.webnic.cc were configured, and no SSL certificate was detected at the time of assessment. Infrastructure checks reveal the domain held a Gridinsoft trust score of 0/100 and appeared on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura.

Six of 93 security vendors on VirusTotal flagged the domain as malicious. The page title 'Defi App' suggests a decentralized finance theme, aligning with the reported scam type of wallet or seed-phishing. The domain is currently offline, though its prior activity and detection history warrant continued monitoring. Defenders should treat this domain as confirmed malicious infrastructure.

Blocking at the DNS or network level is recommended, along with monitoring for related domains registered through the same registrar or resolving to the same IP range. No evidence links this domain to legitimate Apple services, and the absence of SSL further reduces its credibility. The exact content and phishing kit used remain unconfirmed, but the combination of brand impersonation, low trust scores, and blocklist presence supports its classification as high-risk.