cryptomus-air-drop[.]com

Analysis on cryptomus-air-drop.com indicates that the domain was registered on June 05, 2026 through NameSilo, LLC. DNS resolution points to the single IPv4 address 158.94.208.165, which is currently listed on three public security blocklists. The domain is actively blocked by the anti‑phishing services PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high‑risk phishing site. VirusTotal has recorded detections from 11 of 91 scanned security vendors, confirming that multiple engines identify malicious behavior associated with the domain. The threat type is reported as generic phishing, and the risk level is marked high, with the operational status noted as active.

No public information about the site’s SSL certificate, HTTP response codes, or page title has been disclosed, so the exact content and delivery mechanism remain unverified. Likewise, there is no indication of additional infrastructure such as ASN or hosting provider beyond the observed IP address. The lack of detailed page analysis means that defenders cannot confirm the specific lure employed, but the presence on multiple blocklists and vendor detections strongly suggests a credential‑stealing campaign, likely targeting cryptocurrency users given the “cryptomus‑air‑drop” naming. Defenders should immediately add cryptomus-air-drop.com to network and endpoint deny lists, and consider blocking the associated IP address 158.94.208.165 at the perimeter.

Continuous monitoring of DNS queries for this domain is advised, as well as periodic re‑scanning with VirusTotal or equivalent services to capture any changes in detection counts. Organizations employing web filtering or secure email gateways should ensure that the domain is flagged for quarantine. Incident response teams should treat any user‑initiated connections to the domain as suspicious and investigate for potential credential compromise.