airdropvault[.]site

Analysis of the domain airdropvault.site confirms its classification as an active airdrop scam operation, targeting users through brand impersonation tactics. The domain was registered on March 26, 2026, via NameCheap, Inc., and remains operational as of July 12, 2026. Infrastructure analysis reveals resolution to the IP address 198.54.115.40, hosted under Namecheap, Inc. in the United States. The domain employs Cloudflare nameservers (austin.ns.cloudflare.com and karina.ns.cloudflare.com), a common practice among threat actors to obscure backend infrastructure and evade takedown efforts. The page title 'connect' suggests an interface designed to prompt user interaction, likely for credential harvesting or wallet connection, consistent with airdrop scam methodologies. While the exact content and mechanics of the scam are not yet analyzed, the domain has been flagged in eight threat intelligence pulses on AlienVault OTX, indicating prior detection by security researchers. Four of ninety-four security vendors on a public multi-scanner platform have identified the domain as malicious, though the absence of broader detection does not imply safety. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R3, provides basic encryption but offers no assurance of legitimacy. The domain appears on at least one security blocklist and is actively blocked by a phishing detection service. Defenders should treat airdropvault.site as a confirmed malicious resource, prioritize blocking at the DNS or network level, and monitor for related infrastructure. Further investigation into associated IP ranges and certificate reuse may uncover additional linked scam domains.