airdrop-goatcoin[.]com

On July 25, 2026 airdrop-goatcoin.com was identified as a malicious domain engaged in a fake‑airdrop campaign that impersonates the foundation brand. The site’s HTML title, "$GOAT | DEGEN GOAT COIN - MOON OR BROKE 🐐🚀", indicates a cryptocurrency theme unrelated to the targeted brand, confirming the intent to lure victims with a promise of free tokens. The domain was taken offline at the time of analysis, but historical records show it resolved to the IP address 104.21.17.46, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate presented the identifier "WE1", a detail that does not correspond to a recognized certificate authority and may suggest a mis‑issued or self‑signed certificate.

VirusTotal scans recorded 2 detections out of 93 security vendors, providing limited but tangible evidence of malicious activity. Independent blocklists, including PhishDestroy and ScamSniffer, have already listed the domain, and the site appears on two additional security blocklists, reinforcing its classification as a threat. The registrar for the domain is NICENIC INTERNATIONAL GROUP CO., LIMITED, and the domain was created on 21 February 2026, indicating a relatively recent registration typical of fast‑flux or disposable phishing infrastructure. Gridinsoft assigned a trust score of 0 / 100, reflecting an extremely low reputation.

While the exact payload or credential‑collection mechanism cannot be confirmed without a live sample, the convergence of the fake‑airdrop narrative, brand impersonation tag, low trust score, and multiple vendor detections suggests a high likelihood of credential‑harvesting or crypto‑scam activity. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicators, and monitor for any resurgence of the infrastructure, especially given the underlying Cloudflare carrier that can be repurposed for new malicious domains.