airdrop[.]inkonchains[.]xyz

The domain airdrop.inkonchains.xyz was registered on February 21, 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (AS13335) in the United States, resolving to IP address 104.21.69.139. The authoritative nameservers listed are aiden.ns.cloudflare.com and magdalena.ns.cloudflare.com, and the site presents no SSL certificate, which is atypical for legitimate services handling cryptocurrency transactions. A public scan on VirusTotal recorded 13 detections out of 93 security vendors, indicating a moderate level of consensus among malware and phishing tools that the domain is malicious.

The domain appears on a single security blocklist and has a Gridinsoft trust score of 0 out of 100, reinforcing its classification as hostile. PhishDestroy has explicitly blocked the domain, and the only observable HTTP response title is "Just a moment...," a generic placeholder that offers no functional indication of the site’s purpose. The threat type associated with this infrastructure is a crypto drainer, suggesting attempts to lure victims into transferring digital assets to attacker-controlled wallets.

Current operational status is offline, but the elevated risk rating advises continued monitoring. Defenders should add the domain and its associated IP to network deny lists, enforce DNS filtering for Cloudflare‑hosted malicious domains, and monitor for any re‑use of the underlying IP address or similar subdomains. Continuous threat‑intel sharing with blocklist operators is recommended to ensure rapid propagation of this indicator across protective services.