sartoshirip[.]xyz

Analysis of sartoshirip.xyz shows a newly registered domain (creation date 2026-02-21) that has been taken offline but left a trace of a crypto-focused impersonation campaign. The domain resolves to the IP address 172.67.155.25, which is owned by AS13335 (Cloudflare, Inc.) and located in the United States. The hosted page presented the title "mfercoin Token Airdrop", a pattern commonly used in airdrop-scam kits. The kit identifier in the intelligence is "Airdrop Scam", confirming that the site was built to lure victims with a false token distribution promise. The brand target is listed as Metamask, indicating that the attacker attempted to exploit the reputation of the Metamask wallet extension to increase credibility.

VirusTotal scans recorded five positive detections out of ninety-three security vendors, demonstrating that multiple AV engines recognize the domain as malicious. The domain appears on two independent blocklists and has been actively blocked by PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the conclusion that the site is untrusted. The SSL certificate is labeled "WE1", which is atypical for legitimate services and may indicate a self-signed or otherwise suspicious certificate. At the time of analysis the site is offline, limiting direct observation of the payload or credential-capture mechanisms.

No additional data such as Safe Browsing verdicts, Open Threat Exchange references, or registrar details were provided. Consequently, the full scope of the campaign—such as the number of victims or related infrastructure—remains uncertain. Defenders should add the domain name and its resolving IP address to inbound and outbound filtering rules, ensure that any traffic to 172.67.155.25 is monitored for anomalous activity, and apply the same blocklist entries (PhishDestroy, ScamSniffer) across corporate security stacks.