airdrops-goat[.]network

This domain was observed by multiple security feeds and is currently listed as offline. airdrops-goat.network resolves to 172.67.184.251, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is registered through Cloudflare and uses the provider’s default nameservers chelsea.ns.cloudflare.com and marvin.ns.cloudflare.com. No TLS certificate was presented during connection attempts, indicating that the site did not serve HTTPS. The page title returned by HTTP requests is “Gaming”, which does not directly reference the targeted brand.

The infrastructure has been flagged by a single security blocklist and is actively blocked by the PhishDestroy sinkhole. Reputation services assign extremely low scores: Scamadviser 1/100 and Gridinsoft 0/100, reinforcing the malicious nature of the host. Google Safe Browsing classifies the URL as a social‑engineering threat, and VirusTotal reports that 12 of 95 scanned engines label the domain as malicious. The observed scam type is a crypto‑related scam, and the domain explicitly impersonates the Dota 2 brand, a popular Valve game. Evidence confirms that the domain is being used to lure victims into cryptocurrency transactions under the guise of a Dota 2‑related offering, although the exact payload or lure page has not been captured.

Because the site is presently offline, investigators cannot retrieve additional content or confirm the presence of credential‑stealing forms. Defenders should continue to block the domain at perimeter filters, update URL reputation lists with the observed indicators, and monitor for any re‑hosting of the same hostnames or similar subdomains on Cloudflare’s network. Network traffic to 172.67.184.251 should be inspected for anomalous outbound connections, especially those involving cryptocurrency wallets or API calls. Threat‑intel teams are advised to share the indicator set with industry ISACs to accelerate detection of potential redeployments.