cyberkongz-airdrop[.]xyz

Analysis of cyberkongz-airdrop.xyz indicates a brand‑impersonation campaign targeting the Across ecosystem through wallet and seed phishing techniques. The domain was registered on February 21, 2026 via NiceNIC International Group Co., Limited and employs Cloudflare‑hosted nameservers becky.ns.cloudflare.com and west.ns.cloudflare.com. DNS resolution points to IP address 198.18.21.140, an address that is not associated with a known content delivery network and lacks an SSL/TLS certificate, meaning the site was reachable only over plain HTTP when it was active. The observable page title is "$KONG", suggesting a possible connection to a token or airdrop theme, but no further page content has been captured because the site is currently taken offline.

VirusTotal scans report five detections out of ninety‑five security vendors, reinforcing a moderate level of malicious confidence. The domain appears on five external blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, confirming broader community awareness of the threat. Gridinsoft assigns a trust score of zero, reflecting an extremely low reputation.

While the absence of HTTPS and the limited public page data prevent a full content‑level assessment, the convergence of registration timing, IP association, page title, and multiple vendor flags strongly supports classification as a wallet/seed phishing site impersonating Across. Defenders should immediately block the domain and its resolved IP at perimeter devices, add the domain to internal phishing and malware blocklists, and monitor for similarly structured domains that reuse the "airdrop" motif or the "$KONG" title. Ongoing vigilance is advised, especially for users interacting with Across wallets, to prevent credential or seed compromise.