airdrops[.]grassnetwork[.]cfd

Analysis of airdrops.grassnetwork.cfd shows a short-lived infrastructure associated with a crypto drainer campaign. The domain resolves to IP address 172.67.175.105, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. Both authoritative nameservers—amit.ns.cloudflare.com and sandra.ns.cloudflare.com—are Cloudflare‑hosted, indicating the site leveraged the provider’s CDN and DNS services. No SSL certificate was presented, meaning the site operated without HTTPS encryption, a characteristic often observed in fast‑flux or disposable malicious sites.

The page title returned by the server is "Nur einen Moment…", offering no direct indication of the intended victim interaction. Trust metrics are exceptionally low: Gridinsoft assigns a score of 0 / 100 and Scamadviser a score of 1 / 100, reflecting a high likelihood of malicious intent. The domain was registered through Web Commerce Communications Limited on September 29, 2025, and is currently taken offline. Detection data shows that five of ninety‑five VirusTotal scanners flagged the domain, and it appears on a single external blocklist.

PhishDestroy has also blocked the domain, confirming its classification as a crypto‑related scam. Defenders should add the domain and its resolving IP to network‑level blocklists, monitor for any residual traffic to the Cloudflare IP range that may be used by related campaigns, and consider expanding detection rules to include the observed page title string. Given the low trust scores and confirmed vendor detections, any inbound connections to this domain should be treated as hostile. Continuous observation of newly registered domains using the same registrar or similar naming patterns is recommended to pre‑empt future deployments of this threat actor’s infrastructure.