airdrop-checker[.]io

This domain, airdrop-checker.io, is flagged as an active brand impersonation phishing site targeting 1inch, a decentralized cryptocurrency exchange. The threat type is classified as brand_impersonation, with an elevated risk level due to its deceptive design and intent to harvest user credentials or sensitive financial information under the guise of a legitimate airdrop verification service. As of the latest analysis, the domain remains operational and accessible to potential victims. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335) in the United States. The SSL certificate is issued by DigiCert Inc under the Encryption Everywhere DV TLS CA - G2 hierarchy, a common choice for both legitimate and malicious sites due to its low validation requirements. The domain was registered on October 25, 2025, through Name.com, Inc., a registrar frequently utilized for both benign and malicious registrations. Detection metrics indicate that 11 of 95 security vendors on VirusTotal have flagged airdrop-checker.io as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its classification as a phishing threat. Current status assessment confirms that airdrop-checker.io remains active and poses an ongoing risk to users of the 1inch platform. Organizations and individuals are advised to implement immediate countermeasures, including blocking the domain at the DNS or network perimeter level, updating endpoint protection rules to include this indicator of compromise, and alerting users to the presence of this threat. Security teams should monitor for connections to the associated IP address (188.114.97.3) and investigate any internal systems that have interacted with the domain. Given the elevated risk level, users who may have engaged with the site should be instructed to reset credentials, revoke active sessions, and enable multi-factor authentication where applicable. Proactive threat hunting for related infrastructure, such as newly registered domains with similar naming patterns, is recommended to mitigate potential follow-on attacks.