gradient-airdrop[.]trade

This domain, gradient-airdrop.trade, is confirmed as an active brand impersonation scam designed to deceive users into participating in fraudulent airdrop schemes. Analysis indicates the site specifically targets cryptocurrency users by mimicking legitimate airdrop promotions, a tactic commonly associated with crypto drainers and credential harvesting. The domain remains operational as of the latest verification, posing an ongoing threat to unsuspecting victims. Infrastructure analysis reveals the domain was registered on June 30, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.46.6, hosted on Cloudflare's network (AS13335). Security vendors on VirusTotal have flagged the domain, with 2 out of 95 engines detecting malicious activity. The site is currently listed on four security blocklists, including entries from PhishDestroy, Polkadot, Enkrypt, and Codeesura. Notably, the domain lacks an SSL certificate, and its page title, "Cierpliwości...," suggests an attempt to appear legitimate while awaiting user interaction. The domain remains active and continues to pose a high risk to users. Organizations and individuals are advised to block the domain and its associated IP address (104.21.46.6) at the network level. Users should be cautioned against interacting with unsolicited airdrop promotions, particularly those hosted on newly registered domains or lacking proper encryption. Monitoring for similar impersonation patterns, such as domains containing "airdrop" or variations of legitimate project names, is recommended for proactive threat mitigation.