buy-psyop[.]org

Analysis of the infrastructure associated with buy-psyop.org indicates a high‑confidence malicious operation targeting users with a fake airdrop lure. The domain was created on July 21, 2025 and is registered through Web Commerce Communications Limited, a registrar frequently used for disposable or fraudulent sites. DNS resolution points to a single nameserver and resolves to IP address 104.21.80.1, which belongs to AS13335 Cloudflare, Inc. in the United States. Cloudflare’s front‑end service masks the true origin server, limiting attribution beyond the CDN edge. The site served no SSL certificate, implying only HTTP was available at the time of observation.

The page title retrieved from the live site reads "$PSYOP - Expose The Truth | Solana Memecoin," matching the scam type classified as a Fake Airdrop and suggesting a cryptocurrency‑focused bait. The domain impersonates the brand "across," although the page content itself was not examined. Reputation checks show a Scamadviser trust score of 1 out of 100 and the domain appears on one security blocklist. VirusTotal analysis recorded detections by 2 of 95 scanning engines, reinforcing the malicious assessment.

PhishDestroy flagged the domain, and it has since been taken offline, confirming that the hosting was actively removed or the service was shut down. Uncertainties remain regarding any underlying payload or credential‑stealing components because the site is no longer reachable and no sample files have been captured. Defenders should continue to block the domain at network perimeters, add the IP address 104.21.80.1 to deny‑list entries where feasible, and monitor for newly registered domains using similar naming patterns or the same registrar. Additional surveillance of airdrop‑related campaigns targeting the "across" brand is recommended, as the tactics observed here are consistent with broader crypto‑scam campaigns.