# airdropfight.foundation — SUSPICIOUS

> Avoid airdropfight.foundation, a medium-risk crypto drainer domain flagged and now offline. Do not interact or share crypto keys.

## Summary
PhishDestroy identifies airdropfight.foundation as a crypto drainer phishing domain, primarily targeting cryptocurrency users to illicitly access their funds. Classified with a medium risk level, this domain aimed to deceive victims through fraudulent airdrop schemes, siphoning crypto assets without authorization.

The domain was registered on February 21, 2026, through Web Commerce Communications Limited and resolved to IP address 104.21.88.166. VirusTotal flagged it by 4 out of 95 security vendors, and it appeared on one security blocklist. The site currently returns a "404 Not Found" page, indicating the domain is no longer serving malicious content.

As of now, airdropfight.foundation is offline and taken out of operation, mitigating further user exposure. PhishDestroy recommends users avoid this domain and similar suspicious airdrop-related sites, especially those flagged by security vendors. Continuous monitoring of related domains is advised to prevent potential crypto asset theft.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: dead (HTTP 403)
- Scam type: Airdrop Scam
- Page title: 404 Not Found

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- Expires: 2027-01-22 00:00:00
- Registrar: Web Commerce Communications Limited
- Country: MY
- IP: 104.21.88.166
- IP Country: US
- IP City: San Francisco
- IP Org: AS13335 Cloudflare, Inc.
- Nameservers: ["aisha.ns.cloudflare.com", "remy.ns.cloudflare.com"]
- SSL Issuer: Google Trust Services / WE1

## Detection Status
- VirusTotal: 4 vendors flagged
  Vendors: ["Fortinet", "Gridinsoft", "Seclookup", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019bed3c-c22c-7538-97a0-95a8d55e899e.png
- Cloudflare Radar: https://radar.cloudflare.com/scan/503c9451-69cc-4e9f-a1d5-bc993a3c6797
- Wayback Machine: https://web.archive.org/web/https://airdropfight.foundation
- PhishDestroy: https://phishdestroy.io/domain/airdropfight.foundation/
- LLM endpoint: https://phishdestroy.io/domain/airdropfight.foundation/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/airdropfight.foundation/
Last updated: 2026-03-19