0x2201[.]top

This domain, 0x2201.top, is flagged as an active phishing infrastructure targeting users with an Airdrop scam, as indicated by threat intelligence sources. Registered on February 21, 2026, through a registrar associated with low-reputation domains, the site resolves to IP address 104.21.48.28, which is proxied behind Cloudflare, a common tactic to obscure hosting origins and evade takedowns. The presence of HTTP/3 and HSTS further suggests an attempt to mimic legitimate, secure web properties. Security vendors have detected this domain in 24 threat intelligence pulses, and it appears on four blocklists, including SEAL and MetaMask, indicating broad recognition of its malicious intent. Analysis of the infrastructure reveals no direct brand impersonation in the domain name itself, but the identified phishing kit—an Airdrop scam—implies a focus on cryptocurrency or token giveaway fraud. The page title, '522: Connection timed out,' may indicate a temporary outage or a deliberate evasion technique to avoid automated scanning. The SSL certificate issued by Google Trust Services does not confer legitimacy, as free certificates are routinely abused in phishing operations. Defenders should treat this domain as high-risk. Block resolution at the DNS level or network perimeter, and monitor for any attempts to access it from internal systems. Given its recent registration and active status, assume the infrastructure remains under adversary control. If internal logs show connections to 104.21.48.28 or the domain, initiate incident response procedures for potential credential compromise or financial fraud exposure. No further visual or functional analysis of the site has been conducted, so exact payload behavior remains unconfirmed.