aol-coin[.]com

Analysis indicates that the domain aol-coin.com was registered on 27 August 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers cameron.ns.cloudflare.com and rosemary.ns.cloudflare.com resolve the domain to the IP address 172.67.132.55, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is presented for the site, confirming the absence of HTTPS encryption. The single observed page title reads "$AOL Airdrop is Now Live!", and the campaign has been classified as a crypto‑related scam employing an “Airdrop Scam” kit.

Two independent phishing blocklists, PhishDestroy and ScamSniffer, have listed the domain, and VirusTotal reports that two of ninety‑five scanned scanners flagged the host as malicious. The current operational status is recorded as offline as of the report date, 24 July 2026. The evidence points to a classic credential‑harvesting or token‑collection operation that pretends to distribute a fictitious AOL cryptocurrency airdrop. The lack of SSL, combined with the presence on multiple blocklists and the limited VirusTotal detections, suggests low‑to‑moderate exposure but a clear intent to deceive.

Uncertainty remains regarding the full payload delivered to victims, the existence of additional hosting infrastructure, and whether the site ever served malicious binaries, because only the page title and kit classification are available. Defenders should block all traffic to aol-coin.com at the DNS and firewall layers, monitor for connections to the associated Cloudflare IP range, and include the domain in threat‑intel feeds. Organizations that have users with AOL accounts or that monitor crypto‑related communications should alert end users to the fraudulent airdrop claim. Continued observation of the IP address and periodic re‑scans with VirusTotal are recommended to detect any changes in malicious activity.