llm-coin[.]com

On 24 July 2026, the domain llm-coin.com was observed hosting a page titled “$LLM Airdrop is Now Live!”. The page title and the classified scam type “Fake Airdrop” indicate an attempt to lure victims with a fraudulent cryptocurrency airdrop. The domain is registered through NiceNIC International Group Co., Limited and was created on 21 February 2026. DNS resolution points to 172.67.196.152, an address owned by Cloudflare, Inc. (ASN 13335) located in the United States.

The authoritative nameservers are poppy.ns.cloudflare.com and terry.ns.cloudflare.com, confirming Cloudflare as the hosting provider. The site employed Cloudflare’s SSL certificate issued by Google Trust Services under the WE1 root, and it advertised support for HTTP/3, consistent with the provider’s modern edge network. The domain has been added to two public blocklists and is actively blocked by the PhishDestroy and ScamSniffer filtering services. VirusTotal analysis shows that three of ninety‑five scanning engines returned a malicious verdict, reinforcing the suspicion of malicious intent.

No additional intelligence such as malware payloads, credential harvesting forms, or redirection chains has been released, leaving the exact victim‑interaction flow undocumented. Given the offline status reported at the time of analysis, the site is no longer reachable, but the infrastructure components—registration details, Cloudflare hosting, and the SSL configuration—remain reusable for future campaigns. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists with the observed indicators, and monitor for any re‑registration of the same second‑level domain or similar airdrop‑related page titles. Threat‑intel teams are advised to track the associated IP address and Cloudflare nameservers for emergence of new malicious domains, and to share the observed indicators with industry‑wide sharing platforms to improve collective detection.