layeredgeclaim[.]site

Analysis of layeredgeclaim.site, observed as offline at the time of reporting on July 22, 2026, indicates a credential‑harvesting operation targeting Coinbase users through a crypto‑airdrop pretense. The domain was registered on February 21, 2026 via HOSTINGER operations, UAB, and resolves to IP address 153.92.8.121, which is allocated to AS47583 Hostinger International Limited and geolocated in Indonesia. Both authoritative name servers, ns1.dns-parking.com and ns2.dns-parking.com, belong to a generic parking service, suggesting the domain was not actively serving content when scanned but had previously hosted a phishing kit identified as an "Airdrop Scam". The page title captured from historic snapshots reads "LayerEdge Airdrop Eligibility Checker," reinforcing the use of an airdrop‑eligibility check to lure victims.

No TLS certificate was presented, leaving the site exposed to downgrade attacks and confirming the lack of legitimate encryption. The infrastructure footprint places the domain on a single security blocklist and it has been flagged by PhishDestroy, indicating recognition by at least one dedicated anti‑phishing service. VirusTotal recorded a single detection out of 93 scanning engines, which aligns with the low‑profile nature of the campaign. The domain explicitly impersonates Coinbase, positioning the threat within brand‑impersonation risk.

Defenders should continue to monitor the DNS records for any re‑activation, enforce outbound filtering for the domain and its associated IP, and add the host to internal blocklists. User education campaigns should highlight that Coinbase does not request airdrop eligibility checks via third‑party URLs, and any unsolicited prompts should be treated as suspicious. Given the limited detection coverage, threat‑intel sharing with broader feeds is recommended to improve visibility of similar airdrop‑based phishing infrastructure.