airdrop-888[.]xyz

This domain, airdrop-888.xyz, is actively flagged as a high-risk phishing site targeting users through an airdrop scam. Registered on November 14, 2025, via Go Daddy, LLC, the domain resolves to the IP address 185.199.109.153, a host commonly associated with content delivery networks. The page title, '打开 TP 钱包' (translated as 'Open TP Wallet'), suggests an attempt to deceive users into interacting with a cryptocurrency wallet, likely as part of a fraudulent airdrop scheme. Analysis indicates the site is designed to harvest credentials or manipulate victims into transferring assets under false pretenses. Infrastructure analysis reveals the use of Varnish, GitHub Pages, HSTS, and Fastly, which are legitimate technologies but frequently leveraged in phishing campaigns to evade detection or improve performance. The SSL certificate is issued by GoDaddy.com, a common certificate authority, which does not mitigate the malicious intent of the domain. The domain is currently active and has been flagged by 11 out of 95 security vendors on VirusTotal, alongside listings in 23 threat intelligence pulses on AlienVault OTX. It also appears on two security blocklists, reinforcing its classification as a confirmed threat. Defenders should treat this domain as hostile and prioritize blocking it at the network level. The domain’s low trust scores (1/100 on Scamadviser and 0/100 on Gridinsoft) further corroborate its malicious nature. While the exact mechanics of the scam remain unconfirmed due to the absence of deeper forensic analysis, the combination of brand impersonation, cryptocurrency wallet references, and active security vendor detections provides sufficient evidence for immediate mitigation. Monitoring for related domains or IPs, particularly those sharing the same hosting infrastructure, is recommended to preemptively disrupt similar campaigns.