visionairdrop[.]com

The domain visionairdrop.com has been identified as a high-risk brand impersonation domain, actively engaging in an airdrop scam. The site has been flagged by 14 out of 95 security vendors on VirusTotal, indicating a significant level of suspicion among the cybersecurity community. Additionally, the domain appears on three security blocklists, further cementing its status as a potential threat. The domain was created on June 17, 2025, and has since been associated with 22 threat intelligence pulses on AlienVault OTX. The Gridinsoft trust score for this domain is 0 out of 100, which is the lowest possible score and suggests a high likelihood of malicious intent. Despite these red flags, the current page title reads 'Sorry, the website has been stopped,' which may indicate an attempt to evade detection or a temporary shutdown. However, the domain remains active and continues to resolve to the IP address 52.238.73.199, suggesting that the underlying infrastructure is still in place and the threat may re-emerge. The SSL certificate is issued by Let's Encrypt, a common choice for malicious actors due to its ease of acquisition and perceived legitimacy. Defenders should be cautious and monitor this domain closely, as the combination of multiple security flags, a low trust score, and its presence on threat intelligence blocklists strongly suggest that the airdrop scam is a significant risk. Network administrators and security teams should consider blocking this domain and educating users about the dangers of airdrop scams to prevent potential financial losses or data breaches.