airdrop[.]naoristoken[.]world

The domain airdrop.naoristoken.world was registered on February 21, 2026 through Web Commerce Communications Limited. It is hosted on Cloudflare’s network and resolves to the IP address 188.114.97.3, which is listed as a Cloudflare, Inc. node in Canada. The authoritative nameservers are jimmy.ns.cloudflare.com and carioca.ns.cloudflare.com, and the service is delivering traffic over HTTP/3. The site currently returns an HTTP 403 response and its page title is reported as “Just a moment…”, indicating that the front‑end is likely protected by Cloudflare’s challenge page rather than serving malicious content directly.

Threat intelligence platforms have flagged the domain. VirusTotal shows that 6 out of 95 security vendors have raised detections, and the domain appears on at least one public blocklist. Gridinsoft’s trust score is 0 out of 100, reinforcing the low credibility assessment. PhishDestroy has also added the domain to its blocklist. The combination of a low trust rating, multiple vendor detections, and a forced 403 response suggests that the infrastructure is being used to host a malicious payload or to redirect victims after a challenge is passed.

The campaign is classified as a brand‑impersonation operation targeting the cryptocurrency exchange OKX. The advertised scam type is cryptocurrency, implying that victims may be lured with promises of airdrops or token claims tied to the OKX brand. Defenders should block DNS resolution for airdrop.naoristoken.world, monitor outbound connections to the associated Cloudflare IP, and update web filtering rules to deny HTTP requests that result in the “Just a moment…” title from unknown origins. Incident response teams should also correlate any login attempts to OKX with this domain and investigate potential credential harvesting attempts.