airdrop-openiedger[.]xyz

Analysis indicates that airdrop-openiedger.xyz was registered on February 21, 2026 through OwnRegistrar, Inc. The domain resolves to 172.67.155.206, an address owned by AS13335 Cloudflare, Inc. and located in the United States. DNS resolution uses Cloudflare name servers alice.ns.cloudflare.com and leonard.ns.cloudflare.com, and the site is served behind Cloudflare’s CDN, which also supplies the SSL certificate issued by Google Trust Services under the WE1 identifier. An HTTP request returns status code 403 and the page title is “Suspected phishing site | Cloudflare”, confirming that the host is currently presenting a generic Cloudflare block page. Threat intelligence flags the domain as a “Fake Airdrop” campaign that functions as a crypto drainer.

Five of ninety‑three security vendors on VirusTotal have raised detections, and AlienVault OTX lists the domain in a single pulse. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. No additional technologies beyond Cloudflare are observed.

Given the elevated risk rating, defenders should add the domain and its associated IP address to network deny lists, enforce DNS filtering, and monitor for any outbound connections to the Cloudflare edge. Continuous re‑verification of the block status is advised, as the site is presently taken offline but could be re‑activated. Logging of TLS handshake attempts to Google Trust Services‑issued certificates can aid in detecting resurgence. The combination of low trust score, multiple vendor detections, and inclusion in threat‑intel feeds justifies immediate remediation.