# PhishDestroy threat dossier — airdropfinder.cyou ================================================================ Fetched: 2026-05-01 13:20:43 UTC Canonical: https://phishdestroy.io/domain/airdropfinder.cyou/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 88/100 (PhishDestroy scoring — see methodology below) Scam classification: Airdrop Scam Targeted brand: Airdrop Scam ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 3/94 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Gridinsoft, SOCRadar ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 159.203.143.218 (US, Clifton) ASN: AS14061 DigitalOcean, LLC Hosting org: Digital Ocean Registrar: Nicnames, Inc. Nameservers: ["ns10.nicnames.com", "ns11.nicnames.com", "ns12.nicnames.com"] Registered: 2026-04-15 Page title: The domain airdropfinder.cyou is powered by NicNames.com HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-06-02 Status: INVALID chain Fingerprint: adb9913f43f993af9fdd583de3e9c88e8be477df6caa4758168a4cb56e11eac6 Subject Alternative Names (related infrastructure — often same operator): - parkpage.nicnames.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-15 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-15 10:02:08 UTC (by PhishDestroy tracker) Last verified: 2026-04-23 13:40:11 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d8fef-5f34-776d-9799-911250a3b8bc/ Wayback Machine: https://web.archive.org/web/*/airdropfinder.cyou crt.sh CT logs: https://crt.sh/?q=%25.airdropfinder.cyou Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=airdropfinder.cyou AlienVault OTX: https://otx.alienvault.com/indicator/domain/airdropfinder.cyou URLhaus: https://urlhaus.abuse.ch/host/airdropfinder.cyou/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-15 10:02:38 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies airdropfinder.cyou as a newly registered domain actively impersonating legitimate airdrop campaigns to deceive cryptocurrency users. This domain, created on April 13, 2026, mimics the branding of well-known airdrop promotions to trick visitors into connecting wallets or entering private keys, risking direct asset theft. The threat actor leverages social engineering tactics by positioning the site as a 'finder' or aggregator of upcoming airdrops, exploiting user trust in legitimate crypto promotional platforms to harvest credentials or initiate fraudulent transactions. Security teams should treat this as an active fraudulent endpoint with immediate exposure potential to crypto investors scanning for new opportunities. Technical analysis reveals airdropfinder.cyou resolves to IP address 159.203.143.218 and operates under an SSL certificate issued by Let's Encrypt, lending false legitimacy to the phishing facade. The domain was registered through NicNames, Inc., a privacy-focused registrar that often complicates rapid takedown efforts. Currently, VirusTotal shows 0 detections out of 95 AV engines scanned, indicating low signature coverage despite clear malicious intent. The domain's very recent registration date—just days old—suggests it has not yet been widely blacklisted, increasing its window of opportunity for victim engagement. Combined with its targeted impersonation of crypto airdrop platforms, this domain represents a high-impact threat with low initial detection resistance. Users who visited airdropfinder.cyou should immediately disconnect from the site, clear browser cache and cookies, and verify the legitimacy of any crypto-related websites before entering sensitive data. If any wallet connections or private key submissions were made, revoke permissions immediately via the official wallet interface and transfer remaining assets to a new, secure wallet. Report the domain to your organization's security team and local cybercrime authorities. Block the domain at the network level using DNS filtering or firewall rules to prevent further access within your environment. Always cross-reference airdrop announcements with official project channels on verified social media and ensure links are accessed via bookmarked URLs or reputable aggregators to avoid following malicious redirects. ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 818973bf7266ca49f04574c8ad99cd0a TLS cert SHA-256: adb9913f43f993af9fdd583de3e9c88e8be477df6caa4758168a4cb56e11eac6 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/airdropfinder.cyou/ JSON API: https://api.destroy.tools/v1/check?domain=airdropfinder.cyou Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io