airdrop-gobob[.]xyz

Analysis on 24 July 2026 shows that airdrop-gobob.xyz was registered on 20 November 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. The domain resolves to 172.67.222.78, an address owned by Cloudflare (AS13335) located in the United States. DNS resolution uses Cloudflare’s authoritative nameservers may.ns.cloudflare.com and phil.ns.cloudflare.com. No TLS certificate was presented during the scan, indicating the site was served without HTTPS.

The only visible page title returned was “Nur einen Moment…”, a generic German phrase meaning “Just a moment…”. Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist, where it is listed by PhishDestroy. VirusTotal analysis recorded 11 detections out of 95 scanned engines, confirming malicious classification. The threat type is identified as a crypto scam, specifically a crypto drainer, although the exact payload or wallet addresses were not disclosed in the available data.

The domain’s current status is marked as offline, suggesting the malicious site may have been taken down or is temporarily unavailable. Because the infrastructure is hosted on Cloudflare, attribution to a specific actor is difficult, and the lack of SSL and the generic page title hinder further content‑based attribution. Defenders should continue to block the domain at the DNS and proxy layers, monitor for any re‑registration or new sub‑domains pointing to the same IP range, and correlate any outbound traffic from internal hosts to 172.67.222.78 with known crypto‑drainer indicators. Additional investigation should focus on obtaining the original HTTP response body, any associated wallet addresses, and potential command‑and‑control URLs that may have been used before the site went offline.