cryptobotofficial[.]icu

The domain cryptobotofficial.icu was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The domain is served without an SSL certificate, indicating that HTTP traffic is unencrypted. The public page title returned by the web server is “CryptoBot | Airdrop”, which aligns with the observed phishing kit labeled as an “Airdrop Scam” and the broader classification of a crypto‑related scam. Google Safe Browsing has flagged the site for social engineering, and VirusTotal reports that 16 of 93 security vendors have identified the domain as malicious.

The domain is currently listed on one external blocklist and has been taken offline by the mitigation service PhishDestroy. The nameservers in use are brian.ns.cloudflare.com and violet.ns.cloudflare.com, both belonging to Cloudflare’s DNS infrastructure. Analysis indicates that the primary threat vector is brand impersonation of Binance, as explicitly noted in the intelligence. The combination of a brand‑targeted title, a crypto‑airdrop theme, and the absence of TLS suggests an attempt to lure users into providing credentials or private keys under the pretense of an airdrop. While the page content has not been captured, the available indicators—domain age, hosting under a well‑known CDN, detection counts, and blocklist presence—are sufficient to consider the domain high risk.

Defenders should immediately block cryptobotofficial.icu at the network perimeter and add the associated IP address 188.114.97.3 to any existing deny lists. Monitoring for subsequent domains resolving to the same IP range or using the same Cloudflare nameservers is recommended, as threat actors often reuse infrastructure. Continuous re‑scanning of the domain through VirusTotal and other sandbox services is advised in case the site is reinstated.