airdrop[.]laffala[.]app

The domain airdrop.laffala.app was registered on February 21, 2026 through Name.com, Inc. It resolves to the IPv4 address 185.107.74.113, which belongs to AS200430 WEBO LLC and is geolocated in Sweden. The domain is served without an SSL certificate, indicating that only unencrypted HTTP connections are possible. Its authoritative nameservers are ns1crv.name.com, ns2dqr.name.com, ns3gxy.name.com, and ns4cfn.name.com. The web page presents the title "Laffala | Airdrop," matching the known scam type of a fake airdrop and the identified Airdrop Scam phishing kit.

VirusTotal analysis shows that three out of ninety‑five security vendors flagged the domain, providing independent confirmation of malicious intent. The domain appears on two public blocklists, PhishDestroy and ScamSniffer, further evidencing its classification as a crypto drainer. Current operational status is offline, but the historical presence of malicious activity warrants continued monitoring.

Defenders should block any network traffic to the domain and its resolved IP address, enforce HTTP to HTTPS redirection where possible, and add the associated nameservers to watch lists for future reuse. Additionally, security teams should update URL filtering rules to include the domain and consider the IP’s hosting provider as a potential source of related infrastructure. Continuous observation of the IP range owned by WEBO LLC may reveal further campaigns, and any re‑registration of the domain should be treated as high‑risk given its prior use in a fake airdrop cryptocurrency draining operation.