6chicken9[.]top

The domain 6chicken9.top is identified as a brand impersonation scam specifically targeting cryptocurrency airdrop participants. Analysis indicates this infrastructure was designed to deceive users into engaging with fraudulent airdrop offers, likely leading to unauthorized asset transfers or credential harvesting. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented threat. Infrastructure analysis reveals the domain was registered on February 21, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 188.114.96.3, which is part of a network with historical ties to malicious activity. Detection metrics show 4 of 95 security vendors on VirusTotal flagged the domain as malicious, while Gridinsoft assigned a trust score of 0 out of 100. Additionally, the domain appears on one security blocklist, further corroborating its classification as a threat. Technologies detected include Node.js, Vue.js, Nuxt.js, and Cloudflare services, which are often leveraged to obfuscate malicious intent and enhance scalability. Current status indicates the domain is offline, reducing immediate risk to users. However, the threat actor may redeploy similar infrastructure under new domains. Users are advised to verify airdrop legitimacy through official project channels and employ browser-based security tools to block known malicious domains. Cryptocurrency holders should enable transaction previews and multi-factor authentication to mitigate risks associated with asset-draining attacks. Security teams are encouraged to monitor for domains registered through the same registrar or resolving to the identified IP address.