airdrop[.]falcon-finance[.]sbs

The domain airdrop.falcon-finance.sbs was registered on October 02, 2025 through Web Commerce Communications Limited and is currently hosted on Cloudflare infrastructure (AS13335). DNS resolution points to the address 188.114.96.3, which is located in the United States and resolves via the Cloudflare nameservers amit.ns.cloudflare.com and sandra.ns.cloudflare.com. The site lacks an SSL certificate, serving only over HTTP, which is consistent with many low‑trust malicious pages. The page title observed during indexing is "Security Verification – $FF", and the classified scam type is a Crypto Scam, specifically a crypto drainer targeting users of the $FF token.

Reputation services rate the domain extremely poorly, with Scamadviser assigning a trust score of 1 / 100 and Gridinsoft rating it 0 / 100. The domain appears on at least one active blocklist, PhishDestroy, and overall is listed on a single security blocklist. VirusTotal analysis shows that 11 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The domain’s current status is offline, indicating that the malicious infrastructure may have been taken down or is temporarily dormant.

While the observed evidence points to a targeted crypto‑draining operation, the exact payload or transaction‑stealing mechanisms have not been publicly disclosed, leaving the specific attack vector uncertain. Defenders should continue to block the domain at network perimeters, monitor for any resurgence of the host IP, and update detection signatures to include the observed page title and the associated hostnames. Threat intelligence feeds should incorporate the domain’s registration details, hosting provider, and the observed vendor detections to improve early warning capabilities for related crypto‑drainer campaigns.