goblin-allocation[.]com

This domain is flagged as an elevated-risk brand impersonation threat specifically designed to execute an airdrop scam. Analysis indicates the site mimics legitimate cryptocurrency airdrop promotions to deceive users into connecting wallets, likely deploying a crypto drainer to siphon funds. The page title, $Goblin Airdrop, directly aligns with known fraudulent schemes targeting decentralized finance participants. Infrastructure analysis reveals the domain was registered on May 02, 2026, through Global Domain Group LLC and resolves to the IP address 188.114.97.3. It appears on three security blocklists, with a Gridinsoft trust score of 0/100. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Let’s Encrypt, and the site employs HSTS, Cloudflare, and HTTP/3 technologies. Despite its current offline status, historical data confirms active malicious use. Mitigation requires immediate blocking of the domain and associated IP across all network security controls. Users should be alerted to the specific threat of airdrop scams, particularly those requesting wallet connections or private key disclosures. Security teams should monitor for related domains registered under the same registrar or resolving to the same IP range. Wallet providers and exchanges should preemptively warn users about this campaign, emphasizing verification of airdrop legitimacy through official project channels only.