aiairdroprush[.]com

Analysis of the domain aiairdroprush.com, observed on July 23 2026, indicates that it was used to deliver a fake airdrop campaign impersonating the brand “across”. The site employed the publicly‑available “Airdrop Scam” phishing kit, as identified by threat intelligence sources. The page title returned by the server was “Aiairdrop Rush”, which aligns with the advertised scam theme. The domain was registered on 25 March 2025 through Cosmotown, Inc. and is served by the four LyteHosting name servers (dns1.lytehosting.com, dns2.lytehosting.com, dns3.lytehosting.com, dns4.lytehosting.com). DNS resolution points to IP address 163.61.188.222, which belongs to ASN 153568 (NEW DHAKA HARDWARE) and is geolocated in the United States.

No TLS certificate was presented, meaning the site operated over plain HTTP only. The hosting infrastructure has been listed on a single security blocklist; PhishDestroy currently blocks the domain. VirusTotal scans show that five of ninety‑five antivirus engines flagged the domain as malicious, reinforcing the suspicion of malicious activity. The domain’s current HTTP status is offline, indicating that the malicious content has been removed or the site has been taken down. Uncertainty remains regarding the exact content that was served before takedown, as no live page was captured.

Additionally, the limited blocklist presence (only one listing) suggests that broader community detection may be delayed. Defenders should add the domain to internal blocklists, monitor the associated IP and name‑server range for further abuse, and consider the ASN 153568 as a potential vector for related campaigns. Continuous observation of Cosmotown‑registered domains and LyteHosting name servers is advised, as they have been used in prior phishing operations. Organizations that reference the “across” brand should educate users about unsolicited airdrop offers and enforce strict URL verification to mitigate credential harvesting attempts.