# PhishDestroy threat dossier — mail.airdropchecker.space ================================================================ Fetched: 2026-07-24 01:52:10 UTC Canonical: https://phishdestroy.io/domain/mail.airdropchecker.space/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Crypto Drainer Targeted brand: Base ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 1/91 security vendors flagged this domain Flagging vendors: Kaspersky Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 94.130.22.227 (DE, Falkenstein) ASN: AS24940 Hetzner Online GmbH Hosting org: Hetzner Registrar: HOSTINGER operations, UAB Nameservers: ns1.sitechai.com, ns2.sitechai.com Registered: 2026-07-11 Expires: 2027-07-11 Page title: Base Airdrop Checker - Live Web3 Verification Engine HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / YR1 Expires: 2026-10-18 Status: INVALID chain Fingerprint: 5dbbe648ca88085fbcb7a868684fd129209497648bab05d7179a011dc0470541 Subject Alternative Names (related infrastructure — often same operator): - airdropchecker.space - www.claim.wexy.fun ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-07-11 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-07-23 12:10:18 UTC (by PhishDestroy tracker) First reported: 2026-07-23 10:14:55 UTC (abuse notice filed) Last verified: 2026-07-24 00:20:26 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f8e73-9aab-71af-9cf7-d7512b42446c/ URLQuery: https://urlquery.net/report/94b983f0-579d-4949-af77-125caa1d8cbe Wayback Machine: https://web.archive.org/web/*/mail.airdropchecker.space crt.sh CT logs: https://crt.sh/?q=%25.mail.airdropchecker.space Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=mail.airdropchecker.space AlienVault OTX: https://otx.alienvault.com/indicator/domain/mail.airdropchecker.space URLhaus: https://urlhaus.abuse.ch/host/mail.airdropchecker.space/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-07-23 12:10:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is mail.airdropchecker.space a Crypto Drainer? The domain mail.airdropchecker.space was registered on July 11, 2026 through the HOSTINGER operations, UAB registrar. Its authoritative name servers are ns1.sitechai.com and ns2.sitechai.com, and DNS resolution points to the IPv4 address 94.130.22.227. The domain is currently classified as a crypto drainer with a high risk rating and remains active according to the latest intelligence dated July 23, 2026. PhishDestroy has listed the domain on its blocklist, and it appears on one additional security blocklist, indicating that at least one external feed is already flagging the host. VirusTotal analysis shows that a single security vendor out of ninety‑one submitted a detection for the domain, confirming that automated scanning has produced at least one malicious indicator. No further public scanning results, SSL certificate details, HTTP response codes, or page‑title information are available in the current dataset, leaving the exact payload and delivery mechanisms unconfirmed. The limited detection footprint suggests that the campaign may be in an early deployment stage or employing evasion techniques to avoid broader detection. Defenders should proactively block mail.airdropchecker.space at DNS and proxy layers, add the associated IP address 94.130.22.227 to network‑level deny lists, and monitor for any outbound connections to that host. Continuous re‑evaluation of VirusTotal and other multi‑engine scanners is advisable, as additional detections may emerge. Correlation with other domains using the same name‑server pair or hosting provider may reveal further infrastructure sharing. Given the crypto‑drainer classification, any compromise that results in cryptocurrency wallet interactions should be treated as a severe incident, and incident response teams should isolate affected endpoints and conduct forensic analysis to identify potential credential theft or transaction forwarding. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260723-C3D320 TLS cert SHA-256: 5dbbe648ca88085fbcb7a868684fd129209497648bab05d7179a011dc0470541 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/mail.airdropchecker.space/ JSON API: https://api.destroy.tools/v1/check?domain=mail.airdropchecker.space Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 188,976 domains (58,403 alive under monitoring, 128,955 confirmed takedowns/dead). Site: https://phishdestroy.io