mail[.]airdrop-kiloex[.]com

The domain mail.airdrop-kiloex.com was registered on March 28 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently resolved to the IPv4 address 207.174.214.13, which belongs to AS46606 Unified Layer in the United States. The authoritative nameservers ns1.md-91.webhostbox.net and ns2.md-91.webhostbox.net are consistent with the hosting provider observed for other malicious campaigns. HTTP requests return a 200 status code, but the site presents only the generic title “Just a moment…”, and no SSL certificate is presented, indicating the service is delivered over plain HTTP. The domain has been classified as a fake‑airdrop scheme that impersonates the brand x.com, a classic brand‑impersonation vector used to lure victims into providing credentials or crypto wallet information.

Gridinsoft assigns a trust score of 0 out of 100, reflecting an extremely low reputation. VirusTotal scans show that two of ninety‑five security vendors have flagged the domain, and the domain is listed on at least one public phishing blocklist, where it is also blocked by the PhishDestroy service. The combination of a recent registration, lack of TLS, low trust score, and detection by multiple independent sources suggests an active threat infrastructure.

Uncertainty remains regarding the exact payload delivered after the initial page, as the content beyond the title has not been captured in the available intelligence. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for the associated nameservers, and enforce TLS inspection for outbound HTTP traffic to detect any subsequent malicious redirects. Continuous re‑evaluation is advised, as the threat actor may modify the landing page or shift hosting while retaining the same brand‑impersonation tactic.