llm-coin[.]app

Analysis of llm-coin.app indicates the domain was used for a cryptocurrency airdrop scam. The site presented the page title "$LLM Airdrop is Now Live!" and was hosted on the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States. Registration data shows the domain was created through NiceNIC International Group Co., Limited, and its authoritative DNS records point to carl.ns.cloudflare.com and kelly.ns.cloudflare.com. No TLS certificate was observed, meaning the site operated without HTTPS encryption.

VirusTotal scans reported three detections out of ninety‑five security vendors, and the domain is listed on two independent security blocklists. Additional defensive feeds, PhishDestroy and ScamSniffer, have both blocked the domain. The observed infrastructure matches the known "Airdrop Scam" phishing kit, confirming the campaign’s reuse of a publicly available template. As of the report date, July 24, 2026, the domain is marked offline, but the underlying IP remains under Cloudflare control and could be repurposed for future malicious activity.

Defenders should continue to enforce blocklist rules for the domain and its associated IP, monitor for re‑registration or similar subdomains, and consider adding the host to network‑level deny lists. Because the site lacked SSL, any traffic to it would have been vulnerable to interception, reinforcing the need for strict TLS enforcement on client endpoints. Continuous re‑evaluation of the IP reputation is advised, given Cloudflare’s shared hosting model may host unrelated legitimate services alongside malicious ones.