tkusdmall[.]xyz

This domain tkusdmall.xyz is flagged as a high-risk phishing domain associated with an airdrop scam campaign. Registered on June 28, 2025, through Dynadot LLC, the domain resolves to IP address 199.59.243.228 hosted on Amazon.com, Inc. infrastructure in the United States (AS16509). The site currently returns an HTTP 200 status and presents a page title matching the domain name itself, indicating the landing page content has not been categorised in detail. SSL encryption is provided via a Let's Encrypt certificate (YR1). The domain is actively blocked by PhishDestroy and ScamSniffer blocklists, and appears on two security blocklists overall. VirusTotal scanning shows 3 out of 95 security vendors flagging this domain as malicious, reflecting moderate detection among vendors. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. The phishing kit identified is an airdrop scam kit, suggesting the site likely attempts to deceive users into connecting cryptocurrency wallets or sharing sensitive information under the guise of a token distribution. The domain remains active as of the report date. Defenders are advised to block all traffic to this domain at the network and email gateway level, monitor for related domains registered through the same registrar or hosted on the same IP block, and warn users against interacting with any unsolicited airdrop offers linked to this domain. No brand or organisation is named in the available intelligence beyond the generic airdrop scam classification.