# PhishDestroy domain threat record: airdropweb3dutys.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/airdropweb3dutys.com/ Machine-readable companion: https://phishdestroy.io/domain/airdropweb3dutys.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-22 13:24:43 UTC - Last availability or vendor check: 2026-10-22 13:24:43 UTC - Stored record updated: 2026-10-22 16:40:11 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: arbitrum ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com - Last stored HTTP status: 302 - Registration date (registry RDAP, airdropweb3dutys.com): 2026-10-20 02:18:26 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a163c8-4347-73cf-903e-e1ba3c7ba0fc/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/airdropweb3dutys.com - Certificate Transparency search: https://crt.sh/?q=%25.airdropweb3dutys.com - Web Archive lookup: https://web.archive.org/web/*/https://airdropweb3dutys.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy’s automated assessment classifies airdropweb3dutys.com as an Airdrop Scam, describing the site as a fake token airdrop or claim page. The recorded page title reads “Web3 Rewards Explorer.” The domain was first observed by PhishDestroy on 2026-10-22, two days after its registration on 2026-10-20, and returned an HTTP 302 redirect at that time. How the scam works Fake airdrop claim pages typically ask visitors to connect a cryptocurrency wallet and approve a transaction, which can allow the operator to transfer tokens or gain future approval to drain assets without further interaction. Evidence VirusTotal scanned the domain on 2026-10-22 and reported one suspicious detection out of 92 engines, flagged by Ermes. Google Safe Browsing checked on 2026-10-22 and reported no threat. The external blocklists MetaMask and SEAL listed the domain on the same date. OTX recorded four pulses referencing the domain as of 2026-10-22. URLScan’s analysis on 2026-10-22 marked the page as malicious with a score of 67, while its overall verdict was non‑malicious. Cloudflare Radar also labeled the site as phishing on 2026-10-22. Infrastructure The domain was registered on 2026-10-20 through GMO Internet Group, Inc. d/b/a Onamae.com. The recorded IP address was 188.114.97.3, which was associated with Cloudflare's network, and the observed certificate was issued by Let’s Encrypt and was valid until 2027-01-18; DNSSEC was not observed as enabled. What to do Visitors should avoid connecting any wallet or approving transactions on this site and should revoke any approvals if already granted. Organizations should block the exact domain and monitor outbound traffic to the recorded IP addresses. Continue to watch for related indicators, as the presence of the site in blocklists and phishing tags suggests ongoing risk. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a163c8-4347-73cf-903e-e1ba3c7ba0fc/ Cloudflare Radar report: https://radar.cloudflare.com/scan/3c675b2f-44c5-441e-a5dc-7c524acf1d3f URLQuery report: https://urlquery.net/report/4ef9a9f7-9982-44dc-8eeb-0a28e377ca41 Stored capture screenshot: https://i.ibb.co/LXPTGpw7/88d56f47c551.png Cloudflare Radar screenshot (2026-10-22T13:56:40Z): https://screenshots.phishdestroy.io/cf/3c675b2f-44c5-441e-a5dc-7c524acf1d3f.png URLScan screenshot (2026-10-22T13:12:49Z): https://screenshots.phishdestroy.io/us/01a163be-0c77-73c4-98be-329eb4cfcd3d.png URLScan capture report: https://urlscan.io/result/01a163be-0c77-73c4-98be-329eb4cfcd3d/ URLScan screenshot (2026-10-22T13:24:53Z): https://screenshots.phishdestroy.io/us/01a163c9-0974-76ab-a1b4-048c2a873d9b.png URLScan capture report: https://urlscan.io/result/01a163c9-0974-76ab-a1b4-048c2a873d9b/ VirusTotal report: https://www.virustotal.com/gui/domain/airdropweb3dutys.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=airdropweb3dutys.com Revoke token approvals: https://revoke.cash/ Report crypto fraud (Chainabuse): https://www.chainabuse.com/report Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-22 14:28:10 UTC ## Stored page captures - Primary capture: https://i.ibb.co/LXPTGpw7/88d56f47c551.png Captured: 2026-10-22 13:24:43 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a163c8-4347-73cf-903e-e1ba3c7ba0fc.png Captured: 2026-10-22 13:24:43 UTC Source report: https://urlscan.io/result/01a163c8-4347-73cf-903e-e1ba3c7ba0fc/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/3c675b2f-44c5-441e-a5dc-7c524acf1d3f.png Captured: 2026-10-22 13:56:40 UTC Source report: https://radar.cloudflare.com/scan/3c675b2f-44c5-441e-a5dc-7c524acf1d3f SHA-256: 6ab3dd68289990d525025809675232fac10241ed417721ecb69534ad0ca77ea7 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163be-0c77-73c4-98be-329eb4cfcd3d.png Captured: 2026-10-22 13:12:49 UTC Source report: https://urlscan.io/result/01a163be-0c77-73c4-98be-329eb4cfcd3d/ SHA-256: 64e824048fb3999004e8196202c47d7a0e7335463aae12fb88cfe421b4d8e431 - URLScan · 2026-10-22: https://screenshots.phishdestroy.io/us/01a163c9-0974-76ab-a1b4-048c2a873d9b.png Captured: 2026-10-22 13:24:53 UTC Source report: https://urlscan.io/result/01a163c9-0974-76ab-a1b4-048c2a873d9b/ SHA-256: 9d3c1e157d130beb85747d2e39435f842b5d4649bfadf5f6a631657949ad57b9 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-22T13:57:06Z", "uuid": "01a163c8-4347-73cf-903e-e1ba3c7ba0fc", "scanned_at": "2026-10-22T13:24:04Z", "final_url": "https://www.airdropweb3dutys.com/", "status": 200, "redirected": "parent-domain", "redirects": [ { "to": "https://airdropweb3dutys.com/", "from": "http://airdropweb3dutys.com/", "status": 307 }, { "to": "https://www.airdropweb3dutys.com/", "from": "https://airdropweb3dutys.com/", "status": 302 } ], "ip": "172.67.195.40", "domains": [ "umami4.devliang.xyz", "connect.facebook.net", "fonts.gstatic.com", "static.cloudflareinsights.com", "fonts.googleapis.com", "filepk.oss-ap-southeast-3.aliyuncs.com", "airdropweb3dutys.com" ], "ips": [ "57.144.70.128", "104.21.12.163", "142.251.163.94", "104.16.79.73", "47.254.218.28", "172.67.174.228", "172.253.122.95", "172.67.195.40" ], "asns": [ "32934", "13335", "15169", "45102" ], "countries": [ "US", "MY" ], "doc_hash": "761769cb4402f49a02756f6660ef33cb0ab82a267ee5e49780b2252cccffb576", "script_hashes": [ "a5d44b13a2849dff028d5b2d79f09b77a563427f23417b02d03615e49dc59593", "6b9a948e263551cd27dda00fc7a75217abc6ecda226d81bb90b6ba6e168cd0a3", "03a83c09f72f4144d089addf7bbbaec8eb3ec216160461c08dcd0f1358dbb15c" ], "globals": [ "WRE_I18N", "__wreOpenLang", "umami", "fbq", "_fbq", "__cfBeacon" ], "cookies": [ "_fbp" ], "storage_keys": [ "wre:actor", "lastExternalReferrer", "lastExternalReferrerTime" ], "tls": { "san": [ "*.airdropweb3dutys.com", "airdropweb3dutys.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "airdropweb3dutys.com", "protocol": "QUIC", "valid_to": "2027-01-18T01:37:22Z", "valid_from": "2026-10-20T01:37:23Z" }, "domain_age_days": 2, "apex_age_days": 2, "tls_age_days": 2, "tls_valid_days": 89, "requests": 28, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 67, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html" } }, "cf": { "v": 1, "fetched_at": "2026-10-22T14:27:37Z", "uuid": "3c675b2f-44c5-441e-a5dc-7c524acf1d3f", "scanned_at": "2026-10-22T13:56:40Z", "final_url": "https://www.airdropweb3dutys.com/", "status": 200, "redirected": "subdomain", "history": [ { "url": "https://airdropweb3dutys.com/", "status": 302 }, { "url": "https://www.airdropweb3dutys.com/", "status": 200 } ], "dom_hash": "bda27df86ca9f06dae4f999a442664ac67e3ec0ec7d1cd5ab49aff7793cef614", "doc_hash": "761769cb4402f49a02756f6660ef33cb0ab82a267ee5e49780b2252cccffb576", "phishing_v2": [ "phishing" ], "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains", "Coupons", "Shopping & Auctions" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "airdropweb3dutys.com", "type": "A", "value": "104.21.12.163" }, { "name": "airdropweb3dutys.com", "type": "A", "value": "172.67.195.40" }, { "name": "airdropweb3dutys.com", "type": "AAAA", "value": "2606:4700:3035::ac43:c328" }, { "name": "airdropweb3dutys.com", "type": "AAAA", "value": "2606:4700:3031::6815:ca3" }, { "name": "www.airdropweb3dutys.com", "type": "A", "value": "172.67.195.40" }, { "name": "www.airdropweb3dutys.com", "type": "A", "value": "104.21.12.163" }, { "name": "www.airdropweb3dutys.com", "type": "AAAA", "value": "2606:4700:3035::ac43:c328" }, { "name": "www.airdropweb3dutys.com", "type": "AAAA", "value": "2606:4700:3031::6815:ca3" } ], "dnssec_valid": false, "ip": "172.67.195.40", "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-20T02:18:26Z", "updated": "2026-10-20T02:32:52Z", "expires": "2027-10-20T02:18:26Z", "nameservers": [ "courtney.ns.cloudflare.com", "kobe.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T14:26:32Z", "analysis_at": "2026-10-22T13:58:04Z", "stats": { "timeout": 0, "harmless": 53, "malicious": 0, "suspicious": 1, "undetected": 38 }, "detections": { "Ermes": "not recommended" }, "reputation": 0, "tags": [ "dga" ], "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-20T02:18:26Z", "expires": "2027-10-20T02:18:26Z", "updated": "2026-10-20T02:32:52Z", "first_seen": "2026-10-20T00:38:38Z", "dns": [ { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "courtney.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:ca3" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3035::ac43:c328" }, { "ttl": 21600, "type": "NS", "value": "courtney.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.195.40" }, { "ttl": 300, "type": "A", "value": "104.21.12.163" }, { "ttl": 21600, "type": "NS", "value": "kobe.ns.cloudflare.com" } ], "dns_at": "2026-10-22T14:03:29Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "*.airdropweb3dutys.com", "airdropweb3dutys.com" ], "issuer": "Let's Encrypt / YE1", "serial": "63cc64f7db005525789d3065291e9b0a30f", "sha256": "6d5150a8401c2df089ae53b747c46140beafe4235505f90fce388a176e03cddd", "subject": "airdropweb3dutys.com", "valid_to": "2027-01-18T01:37:22Z", "valid_from": "2026-10-20T01:37:23Z" }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "registrar_iana_id": "49", "registrar_url": "https://internet.gmo/", "created": "2026-10-20T02:18:26Z", "updated": "2026-10-20T02:32:52Z", "expires": "2027-10-20T02:18:26Z", "status": [ "ok" ], "nameservers": [ "courtney.ns.cloudflare.com", "kobe.ns.cloudflare.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2027-10-19T15:00:00Z", "last changed": "2026-10-20T02:32:52Z", "registration": "2026-10-19T17:18:27Z", "registrar expiration": "2027-10-19T15:00:00Z", "last update of RDAP database": "2026-10-20T04:28:04Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-22T13:55:59Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "airdropweb3dutys.com" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-22T13:27:41Z", "first": "2026-10-22T13:27:41Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 2028 }, "social_tags": { "title": "Web3 Rewards Explorer", "themeColor": "#0B0B14" }, "trackers": { "requests": 21, "trackers": [ { "name": "Facebook", "company": "Meta", "country": "US", "category": "Advertising", "requests": 3 }, { "name": "Facebook Custom Audience", "company": "Meta", "country": "US", "category": "Advertising", "requests": 1 }, { "name": "Google Fonts", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Google Static", "company": "Google", "country": "US", "category": "Hosting", "requests": 2 }, { "name": "Facebook Connect", "company": "Meta", "country": "US", "category": "Site Analytics", "requests": 2 } ] }, "mixed_content": { "no_sri": [ "https://umami4.devliang.xyz/script.js", "https://filepk.oss-ap-southeast-3.aliyuncs.com/website/js/index.js" ], "third_party_scripts": 2 }, "status": { "up": true, "code": 302, "timings": { "dns": 18, "tls": 43, "wait": 32, "connect": 7, "download": 0 }, "response_ms": 100 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "carbon": { "bytes": 1663, "co2_grams": 0.0001, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "162.159.44.193", "host": "kobe.ns.cloudflare.com" }, { "ip": "172.64.34.130", "host": "courtney.ns.cloudflare.com" } ], "zone": "airdropweb3dutys.com" }, "cookies": { "cookies": [ { "name": "_fbp", "same_site": "Lax" } ] }, "location": { "ip": "2a06:98c1:3121::9", "asn": "13335", "org": "CloudFLARENET-EU", "city": "London", "country": "GB" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "airdropweb3dutys.com" }, "dns": { "A": [ "188.114.96.9", "188.114.97.9" ], "NS": [ "kobe.ns.cloudflare.com", "courtney.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"courtney.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418114220, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2a06:98c1:3121::9", "2a06:98c1:3120::9" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": false, "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2a06:98c1:3121::9", "family": 6 }, "redirects": { "chain": [ "https://airdropweb3dutys.com", "https://www.airdropweb3dutys.com" ], "count": 1 }, "tech_stack": { "technologies": [ "Facebook Pixel", "core-js", "Google Font API", "Cloudflare", "HTTP/3" ] }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-10-20T02:18:26Z", "updated": "2026-10-20T06:38:07Z", "expires": "2027-10-20T02:18:26Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "courtney.ns.cloudflare.com", "kobe.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html" } } } } ```