beanexchange[.]art

beanexchange.art is a newly registered domain (created 27 Feb 2026) that was observed hosting an Airdrop Scam kit. The authoritative nameservers are ray.ns.cloudflare.com and summer.ns.cloudflare.com, and the domain resolves to 104.21.44.94, an address owned by AS13335 Cloudflare, Inc., in the United States. No TLS certificate is presented, meaning the site was served over plain HTTP, which is atypical for legitimate cryptocurrency services. The only page title retrieved before the site was taken offline reads “Airdrop of $BEAN!”, matching the “Crypto Scam” classification in the intelligence feed.

The registrar listed is NiceNIC International Group Co., Limited. Detection evidence shows the domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. VirusTotal analysis returned 2 detections out of 93 scanning engines, confirming that at least two independent scanners flagged the host as malicious. No Safe Browsing, OTX, or additional blocklist entries are currently recorded, and the site’s HTTP status code is not available because the service is offline.

Given the limited but consistent indicators—recent registration, use of a Cloudflare front‑end without TLS, a page title promising a token airdrop, and confirmation from both a blocklist and multiple VirusTotal engines—defenders should treat beanexchange.art as a high‑confidence malicious indicator. Recommended actions include adding the domain to DNS‑level deny lists, blocking outbound connections to its IP address (104.21.44.94), updating intrusion‑detection signatures to capture the “Airdrop Scam” kit fingerprint, and monitoring for new domains that reference $BEAN or similar airdrop terminology. User education should emphasize that unsolicited airdrop offers are a common lure for credential harvesting and token theft. Continuous re‑scanning is advised in case the host is re‑hosted or the infrastructure changes.