verify[.]t3rn[.]run

Analysis of the domain verify.t3rn.run indicates it was actively involved in a credential phishing campaign targeting cryptocurrency users under the guise of a TRN airdrop eligibility check. The domain, created on February 21, 2026, resolved to the IP address 172.67.167.223, hosted on Cloudflare's infrastructure (AS13335) in the United States. The SSL certificate was issued by WE1, a provider commonly observed in phishing operations. The page title, 't3rn | Check Your BRN for TRN Airdrop Eligibility,' explicitly references the t3rn project and a fabricated airdrop, a tactic frequently employed to harvest login credentials or wallet details from unsuspecting victims.

Detection metrics reveal limited but targeted awareness: two of ninety-three security vendors flagged the domain on VirusTotal, while two blocklists—PhishDestroy and ScamSniffer—have listed it. The scam type is classified as a crypto scam, consistent with the airdrop-themed lure. Infrastructure analysis shows the domain was taken offline prior to this report, though residual risk remains for users who may have interacted with it during its active period. The use of Cloudflare hosting is notable, as it provides both legitimacy and obfuscation, complicating takedown efforts.

Defenders should treat this domain as a confirmed phishing threat. Network-level blocking of 172.67.167.223 and the domain itself is recommended, alongside monitoring for related subdomains or IPs associated with the same registrar or SSL issuer. While the exact phishing kit ('Airdrop Scam') is referenced in intelligence sources, further forensic analysis of the kit's payload is not available at this time. Organizations should prioritize user education on airdrop scams, particularly those leveraging high-profile crypto projects, and verify eligibility through official channels only.