airdrop[.]stealthxr[.]org

This domain, airdrop.stealthxr.org, operates as a brand impersonation scheme specifically targeting the Across cross-chain protocol. Analysis indicates the site mimics legitimate Across token airdrop campaigns, presenting itself under the title 'STEALTH XR PROJECT' to deceive users into connecting wallets or disclosing private keys. The threat type aligns with crypto drainer tactics, where victims risk unauthorized token transfers upon interaction with malicious smart contracts or phishing forms embedded in the site. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on April 23, 2025, through Internet Domain Service BS Corp, with a notably low Scamadviser trust score of 36/100 and a Gridinsoft trust score of 0/100. It resolves to IP address 104.21.64.1 and is flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and employs Cloudflare for hosting, utilizing technologies such as React and HTTP/3, which may obscure detection efforts. Users who visited airdrop.stealthxr.org should immediately revoke any wallet permissions granted to the site via blockchain explorers or wallet management tools. Monitor transaction histories for unauthorized transfers, particularly those involving Across or related tokens. If private keys or seed phrases were entered, transfer all assets to a new wallet and consider reporting the incident to relevant blockchain security teams. Avoid interacting with any domains associated with 'STEALTH XR PROJECT' or similar unsolicited airdrop promotions.