mchain-airdrop[.]xyz

Analysis of the domain mchain-airdrop.xyz, registered on 21 February 2026, indicates an elevated‑risk crypto‑related impersonation campaign targeting MetaMask users. The site’s HTML title, “The Value Layer for ZK”, does not reference MetaMask but the domain is explicitly flagged as impersonating the MetaMask brand. Infrastructure analysis shows the domain resolves to IP address 104.21.3.118, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate is identified as “WE1”, suggesting a low‑trust or possibly self‑signed certificate. A Gridinsoft trust score of 0 / 100 further confirms the lack of legitimacy.

Multiple defensive feeds have independently blocked the domain. PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura list the domain as malicious, and it appears on five additional security blocklists. VirusTotal reports five out of ninety‑three scanners flagging the domain, reinforcing the consensus that it is associated with a crypto scam. The site’s current HTTP status is offline, indicating that the malicious content has been taken down or the server is no longer responding.

The available evidence does not reveal the specific phishing kit or the exact content that was served before takedown, and no public OTX or registrar details were provided. Consequently, the precise attack vector—such as credential harvesting or wallet draining—remains uncertain. Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor for any resurgence of the domain or related subdomains. Threat‑intel teams should also correlate any observed MetaMask‑related credential submissions with this indicator and consider sharing the indicator of compromise with industry sharing platforms.