airdrop[.]newxaigork[.]live

airdrop.newxaigork.live was observed in a crypto drainer campaign and taken offline prior to the analysis date of July 24, 2026. The domain was registered on February 27, 2026 through NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers aiden.ns.cloudflare.com and magdalena.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate was presented during the brief connection attempt, indicating that the site operated without HTTPS encryption.

The HTTP response returned a page with the title “Just a moment…”, a generic placeholder often employed by malicious actors to delay analysis. Reputation scoring from Gridinsoft assigned a value of 0 out of 100, reflecting a complete lack of trust. VirusTotal analysis recorded four positive detections out of ninety‑three scanned engines, confirming that multiple security vendors flagged the domain as malicious. The domain appears on a single external blocklist and is actively blocked by the PhishDestroy service.

The limited detection footprint suggests that the campaign was short‑lived or that the site was removed before broader exposure. Uncertainty remains regarding the exact payload delivered to victims, the specific cryptocurrency addresses targeted, and any command‑and‑control infrastructure that may have been used. Defenders should continue to block the domain at network perimeter devices, update URL filtering feeds with the observed indicator, and monitor for any traffic to the underlying Cloudflare IP address that could be associated with related infrastructure. Ongoing threat‑intel collection is recommended to capture any re‑use of the registrar or hosting configuration in future campaigns.