birbmeme[.]xyz

Analysis of birbmeme.xyz indicates that the domain was created on 21 February 2026 and is currently taken offline. The site resolved to IP address 188.114.97.3, which is hosted by Cloudflare (ASN 13335) and geolocated to the United States. Registration was performed through Eranet International Limited and the domain uses Cloudflare nameservers dakota.ns.cloudflare.com and jo.ns.cloudflare.com. No TLS certificate is present, resulting in an unsecured HTTP endpoint. The Gridinsoft trust score for the domain is 0 out of 100, reflecting a high confidence of malicious intent.

Threat intelligence from AlienVault OTX lists the domain in a single pulse, and VirusTotal reports five detections out of ninety‑three scanned vendors. The domain is listed on four public blocklists and has been actively blocked by PhishDestroy, MetaMask, ScamSniffer, and SEAL. Content analysis shows a page title of “Moonbirds Airdrop”, and the campaign is classified as a crypto‑scam using an Airdrop phishing kit that impersonates Revolut. The evidence points to a brand‑impersonation attempt aimed at extracting cryptocurrency or credentials under the guise of an airdrop offering.

Uncertainty remains regarding the exact payload delivered to victims, as the site content has not been captured and the offline status prevents live inspection. Defenders should continue to block the domain at DNS and proxy layers, monitor for any residual traffic to the associated IP address, and add the domain to internal threat intelligence feeds. Correlation with other Revolut‑related phishing activity should be performed, and alerts should be generated for any future registrations that reuse the same registrar, nameserver pattern, or Cloudflare‑hosted IP range. Ongoing review of the five VirusTotal detections can provide additional indicators of compromise for endpoint protection rules.