airdrop[.]oilcoin[.]today

Analysis of airdrop.oilcoin.today confirms its classification as a high-risk crypto-drainer domain, currently active and leveraging Cloudflare infrastructure. The domain was registered on March 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, with nameservers maya.ns.cloudflare.com and amos.ns.cloudflare.com, indicating Cloudflare as the DNS provider. It resolves to the IP address 188.114.97.3, hosted under Cloudflare’s network, and presents an HTTP 403 status with the page title 'Just a moment...', a common Cloudflare interstitial response that may obscure malicious content from automated scanners. Eleven out of ninety-five security vendors on VirusTotal have flagged this domain as malicious, aligning with its presence on at least one security blocklist. The domain’s SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the Gridinsoft trust score of 0/100 further supports its classification as untrustworthy, the absence of additional context—such as the specific crypto-drainer kit in use or victim reports—limits attribution beyond the observed infrastructure. Defenders should treat this domain as an active threat, particularly in environments where cryptocurrency transactions occur. The use of Cloudflare complicates traditional takedown efforts, as the service masks the origin server and provides DDoS protection. Network-level blocking of the IP 188.114.97.3 or the domain itself is recommended, alongside monitoring for connections to this endpoint, especially from systems handling wallet credentials or crypto-related activities. The domain’s registration age of approximately four months suggests it may remain active for an extended period unless disrupted by additional security interventions.