airdrop-iinea[.]build

Analysis of airdrop-iinea.build indicates that the domain was created on September 10, 2025 and is currently taken offline. The authoritative nameservers alice.ns.cloudflare.com and leonard.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.72.54, which is associated with AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented, meaning the site serves HTTP only, which reduces transport security and is consistent with many low‑effort cryptocurrency fraud operations. The registrar listed for the domain is DevExpanse Ltd d/b/a Regery.com, and the domain has been recorded on a single security blocklist.

Gridinsoft, an end‑point trust scoring system, assigned a trust score of 0 out of 100, indicating a complete lack of confidence in the site's legitimacy. The page title returned from the live site, "888 Donation," aligns with the reported scam type of a crypto donation fraud, often used to lure victims into sending cryptocurrency under the pretense of charitable contributions. VirusTotal has flagged the domain on two of ninety‑five scanners, providing independent vendor corroboration of malicious intent. PhishDestroy has also listed the domain as blocked, adding another layer of community‑based detection.

While the exact phishing page content has not been captured, the combination of a zero‑trust score, lack of SSL, Cloudflare‑only hosting, a donation‑related title, and multiple vendor detections strongly suggests a crypto drainer operation. Uncertainties remain regarding the specific payment addresses or social engineering tactics employed, as those details were not disclosed in the available intelligence. Defenders should continue to block the domain at perimeter filters, monitor for any resurgence of the host under new IPs, and apply indicator‑of‑compromise (IOC) rules that include the domain name, the associated IP address 104.21.72.54, and the observed page title.