watchor[.]xyz

Analysis of the domain watchor.xyz indicates it was actively used for a crypto airdrop phishing campaign, as evidenced by its page title 'Watchoor Airdrop | Claim & Check Your Watchoor Rewards' and classification as a crypto scam. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolved to the IP address 188.114.96.3, which is part of Cloudflare's infrastructure (AS13335) located in the United States. As of the report date, the domain has been taken offline, though its infrastructure remains documented for defensive purposes. Security vendor detections on VirusTotal show that 7 out of 93 engines flagged watchor.xyz as malicious, while it also appears on two security blocklists, including PhishDestroy and ScamSniffer.

The domain employed Cloudflare nameservers (chloe.ns.cloudflare.com and henry.ns.cloudflare.com) and utilized a Let's Encrypt SSL certificate (serial number E7), along with technologies such as HSTS, Cloudflare Browser Insights, and HTTP/3. The use of Cloudflare's services is consistent with phishing infrastructure observed in other crypto-related scams, where threat actors leverage CDN protections to obscure hosting origins and evade takedowns. The scam type is explicitly identified as a crypto scam, likely targeting users with fraudulent airdrop claims. While the exact mechanics of the phishing kit ('Airdrop Scam') are not detailed in available intelligence, the page title suggests an attempt to deceive victims into interacting with a fake reward system.

Defenders should treat this domain as part of a broader pattern of crypto-themed phishing, particularly those impersonating airdrop events. Network-level blocking of the IP 188.114.96.3 and monitoring for related domains registered through NiceNIC or using Cloudflare nameservers may help mitigate further exposure. The domain's current offline status does not preclude its reuse or the emergence of successor domains with similar tactics.