openairdrop[.]sbs

This domain, openairdrop.sbs, is identified as a brand impersonation threat targeting the Across protocol, specifically deploying an airdrop scam phishing kit. The domain is currently offline but was previously active in distributing fraudulent token distribution schemes under the guise of legitimate airdrops. Analysis indicates this infrastructure was designed to deceive users into interacting with malicious smart contracts or disclosing private keys. Infrastructure analysis reveals the domain was registered through Atak Domain on November 08, 2025, and resolved to the IP address 104.21.95.7. It was flagged by 2 of 95 security vendors on VirusTotal and appears on 4 security blocklists, including Codeesura and Polkadot. The domain employed Cloudflare and Hostinger technologies, with an SSL certificate issued by Google Trust Services. The Gridinsoft trust score for this domain is 0/100, further confirming its malicious nature. The page title, 'OpenAirdrop - Universal Token Distribution,' aligns with common phishing tactics used to mimic legitimate token distribution events. As of the latest assessment, openairdrop.sbs has been taken offline, reducing immediate risk to users. However, organizations and individuals are advised to block the domain and its associated IP address (104.21.95.7) at the network level. Users who interacted with this domain should revoke any connected smart contract approvals and monitor wallet activity for unauthorized transactions. Security teams should update detection rules to include this domain and its indicators of compromise (IoCs) in threat intelligence feeds.