airdrop-xyzverse[.]org

airdrop-xyzverse.org is a newly registered domain created on March 14 2026 and listed under the NiceNIC International Group Co., Limited registrar. The domain resolves to the IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is delegated to the Cloudflare nameservers clay.ns.cloudflare.com and meilani.ns.cloudflare.com, indicating that the site is protected and possibly masked by Cloudflare’s reverse‑proxy service. The TLS certificate presented by the site is issued by Let’s Encrypt (certificate identifier E7) and includes HTTP Strict Transport Security (HSTS), confirming that the server enforces secure connections. HTTP/3 support and Cloudflare Browser Insights are also detected, suggesting a modern web stack that can evade some legacy detection mechanisms. Threat intelligence flags the domain on a single security blocklist and records a block by PhishDestroy.

VirusTotal analysis shows that 15 of 91 scanned security vendors flagged the domain, reinforcing the suspicion of malicious activity. The page title returned by the server is “Just a moment…”, a generic placeholder that provides no insight into the site’s purpose. The reported scam type is “Crypto Scam”, specifically a crypto drainer, consistent with the observed indicators. The current operational status is listed as offline, meaning the site is not actively serving content at the time of assessment. However, the underlying infrastructure—Cloudflare edge IP, valid TLS certificate, and HSTS—remains in place and could be re‑activated quickly.

No public samples of phishing kits, victim reports, or malicious payloads have been disclosed, leaving the exact methodology of the crypto draining unknown. Defenders should add asterisk‑airdrop-xyzverse.org to DNS‑based blocklists and firewall deny lists, especially those that filter outbound connections to known Cloudflare edge nodes used by malicious actors.