ethereumairdrop[.]sbs

Analysis of ethereumairdrop.sbs indicates a brand-impersonation operation targeting Ethereum users. The site presented the page title “Ethereum Airdrop – Claim Your Free ETH Tokens,” which directly references the Ethereum brand and suggests a wallet/seed phishing campaign. Registry data shows the domain was created on 23 July 2025 and is registered through ERANET INTERNATIONAL LIMITED. DNS resolution points to 172.67.203.195, an address owned by Cloudflare, Inc. (ASN 13335) located in the United States. The domain uses Cloudflare’s default nameservers molly.ns.cloudflare.com and roman.ns.cloudflare.com and does not present an SSL certificate, indicating the site was served over plain HTTP before being taken offline.

Reputation services assign extremely low trust scores: Scamadviser reports 1/100 and Gridinsoft 0/100. The domain appears on a single security blocklist and is explicitly blocked by the PhishDestroy feed. VirusTotal analysis records ten of ninety‑five scanning engines flagging the domain as malicious, reinforcing the suspicion of a phishing kit identified as “Airdrop Scam.” The observed scam type is classified as wallet/seed phishing, and the impersonated brand is Ethereum. Current status is offline, limiting direct observation of the page content, scripts, or payloads.

Consequently, specifics such as form fields, redirect behavior, or embedded trackers remain unknown. However, the combination of the deceptive page title, low trust scores, blocklist inclusion, and multiple vendor detections provides a high confidence indication of a credential‑harvesting infrastructure. Defenders should add ethereumairdrop.sbs to URL filtering and firewall deny lists, monitor for other domains that resolve to the same Cloudflare IP range, and watch for future registrations that reuse the “airdrop” keyword pattern. Continuous review of threat‑intel feeds for related “Airdrop Scam” kits is recommended to pre‑empt replication of this campaign.