airdrop[.]sonicnft[.]info

The domain airdrop.sonicnft.info was registered on July 29, 2025 through NameSilo, LLC and is presently taken offline. DNS resolution points to the IPv4 address 193.233.113.164, which belongs to AS205775 NEON CORE NETWORK LLC and is geolocated in Finland. The domain is served by the authoritative nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com. No TLS certificate is presented, meaning the site operates without HTTPS protection.

The page title returned from the site, "Aura SkyPool - Dubai's Premier 360° Infinity Pool Experience | Al Habtoor City," bears no relation to the claimed brand, yet the infrastructure is classified as a "Fake Airdrop" that impersonates WhatsApp. Threat intelligence sources indicate that the site has been placed on a single security blocklist and is actively blocked by PhishDestroy. Independent analysis on VirusTotal shows that five of ninety‑five scanning engines flag the domain as malicious, reinforcing the suspicion of fraudulent activity. Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation.

While the exact content of the page has not been captured, the combination of brand impersonation, lack of encryption, low reputation scores, and detection by multiple vendors suggests a high likelihood of credential‑stealing or malware distribution. Defenders should immediately add airdrop.sonicnft.info and its resolving IP 193.233.113.164 to blocklists at the network perimeter, update intrusion‑detection signatures to catch similar "airdrop" subdomains, and monitor the associated nameservers for any re‑registration attempts. Continuous watch of the registrar NameSilo for new domains leveraging the same naming pattern is advised, as threat actors often recycle infrastructure after takedown. Given the offline status, active takedown efforts have succeeded, but the underlying hosting provider and DNS configuration remain viable for future campaigns, warranting ongoing vigilance.