airdropledger[.]com[.]cornixbots[.]com

This domain, airdropledger.com.cornixbots.com, is flagged as a brand impersonation threat targeting Across Protocol, a decentralized cross-chain bridging platform. Analysis of the page title, 'ASTER - Airdrop,' suggests an attempt to deceive users by mimicking legitimate token distribution events, a common tactic in cryptocurrency-related phishing campaigns. The domain does not currently exhibit direct evidence of a drainer kit, but the combination of airdrop-themed content and brand impersonation aligns with known attack vectors used to harvest credentials or private keys. Infrastructure analysis reveals the domain was registered through Ultahost, Inc. and resolves to the IP address 54.38.153.190. It was created on February 21, 2026, indicating a recently established operation. Detection metrics show 12 out of 95 security vendors on VirusTotal flag the domain as malicious, while it appears on one additional security blocklist. The domain has not been listed in Google Safe Browsing (GSB) at the time of analysis, and Gridinsoft assigns it a trust score of 0/100, further confirming its malicious classification. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its inactive status, residual risk remains for users who may have interacted with the domain prior to its removal. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users who engaged with the site should revoke any connected wallet permissions, monitor for unauthorized transactions, and rotate credentials for any accounts linked to the phishing attempt. Continuous monitoring for related domains or infrastructure reuse is recommended, as threat actors frequently re-deploy similar tactics under new domains.