tedra-airdrop[.]com

On 22 July 2026 the domain tedra-airdrop.com was observed as offline but retains a history of malicious activity targeting the cryptocurrency data provider CoinMarketCap. The domain was registered on 13 July 2025 through the HOSTINGER operations, UAB registrar. DNS resolution points to IP address 92.113.23.42, which belongs to AS47583 Hostinger International Limited and is geolocated in Germany. The web server presented an SSL certificate identified as “R10”, and the page title returned by HTTP requests was “v0 App”. The site was classified as a Crypto Scam and explicitly impersonates the CoinMarketCap brand, satisfying the criteria for a brand‑impersonation campaign.

Threat intelligence feeds corroborate the malicious nature of the domain. VirusTotal recorded detections from 2 of 93 security vendors. The domain appears on four independent security blocklists and has been actively blocked by PhishDestroy, Polkadot, Enkrypt, and Codeesura. A Gridinsoft trust score of 0 out of 100 further indicates a lack of legitimacy.

No additional analysis of page content is available because the site is no longer reachable, leaving the exact phishing layout and payload unknown. Given the confirmed impersonation of CoinMarketCap, the presence on multiple blocklists, and the low trust score, defenders should continue to deny any network traffic to tedra‑airdrop.com, add the domain to local deny lists, and monitor for any future resurrection of the site or related infrastructure. Analysts should also watch for other domains resolving to the same IP or registered by the same registrar, as they may be part of a broader campaign. The offline status does not guarantee the cessation of activity; threat actors often reactivate infrastructure after a takedown, so ongoing vigilance is advised.