frzclub[.]xyz

Analysis of frzclub.xyz indicates that the site was used to host a crypto‑related airdrop phishing kit and is now taken offline. The domain resolves to the Cloudflare address 104.21.89.164, which is registered to AS13335 in the United States. DNS resolution is handled by roman.ns.cloudflare.com and teresa.ns.cloudflare.com, both standard Cloudflare name servers. The site did not present an SSL/TLS certificate, leaving the HTTP connection unencrypted and facilitating content manipulation. The page title returned from the site, "FRZ — Frozen Protocol | Airdrop," aligns with the known "Airdrop Scam" kit, confirming a targeted crypto airdrop lure.

Registration data shows the domain was created on March 03, 2026 through NiceNIC International Group Co., Limited, a registrar that has been observed in other malicious registrations. Threat intelligence sources list the domain on one security blocklist and it is explicitly blocked by PhishDestroy. VirusTotal scans report that four out of ninety‑four security vendors flagged the domain, providing independent corroboration of malicious intent. Additionally, the Gridinsoft trust score is 0 out of 100, underscoring the low reputation of the host. The combination of a newly created domain, lack of TLS, low trust score, detection by multiple vendors, and presence on a blocklist points to a high likelihood that the site was employed for a crypto‑scam phishing campaign.

Uncertainty remains regarding any residual infrastructure that may have been reused, as the site is currently offline and no further content is observable. Defensive actions should include adding frzclub.xyz to network blocklists, monitoring the associated Cloudflare IP for repeat abuse, and reviewing any outbound traffic that may attempt to resolve the domain. Organizations should also alert users about unsolicited airdrop offers tied to the "Frozen Protocol" name, as the kit appears to exploit interest in emerging cryptocurrency projects.