airdrop-perceptron[.]xyz

Analysis of the domain airdrop-perceptron.xyz indicates it was actively used as a crypto drainer phishing site before being taken offline. The domain was registered on November 20, 2025, through NiceNIC International Group Co., Limited and resolved to the IP address 95.214.235.117, hosted by Virtual Systems LLC (AS30860) in Ukraine. At the time of investigation, the domain's nameservers were ns13.v-sys.org and ns14.v-sys.org, and no SSL certificate was present. The page title displayed 'Account Suspended,' suggesting the site had been disabled or restricted by the hosting provider or registrar.

Infrastructure evidence shows the domain appeared on two security blocklists, and 15 of 95 security vendors on VirusTotal flagged it as malicious. Detection engines PhishDestroy and ScamSniffer specifically classified it as a crypto scam, aligning with the observed threat type of crypto drainer. The domain's current offline status limits further live analysis, but historical data confirms its use in fraudulent activity targeting cryptocurrency users. Defenders should treat this domain as compromised infrastructure.

While it is no longer active, the registration and hosting patterns—particularly the use of Virtual Systems LLC and the v-sys.org nameservers—are consistent with other known crypto drainer campaigns. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as threat actors often reuse hosting providers and naming conventions. If historical logs or network traffic indicate user interaction with this domain, affected wallets should be audited for unauthorized transactions.