skyroon-airdrop[.]xyz

This domain, skyroon-airdrop.xyz, poses a significant threat as an airdrop scam impersonating legitimate cryptocurrency airdrop campaigns. The site is designed to trick users into connecting their wallets or providing private keys under the guise of claiming free tokens. Once connected, attackers deploy crypto drainer scripts that automatically transfer funds from the victim's wallet to addresses controlled by the threat actor. The domain remains active as of analysis, meaning ongoing risk to anyone who visits.

Technical analysis confirms the malicious nature of skyroon-airdrop.xyz through multiple indicators. VirusTotal reports 4 out of 95 security vendors flag the domain, indicating broad industry consensus on its threat status. The domain was created on June 30, 2026, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for minimal oversight. It resolves to IP address 188.114.96.3 and uses an SSL certificate from Google Trust Services, which provides a false sense of security to visitors. The domain appears on 2 security blocklists and is already blocked by MetaMask and SEAL, demonstrating active threat intelligence sharing.

If you have visited skyroon-airdrop.xyz, take immediate action. Do not enter any wallet credentials, seed phrases, or private keys on the site. Disconnect any wallet that was connected to the domain through browser extensions. Revoke token approvals for any contracts associated with the site using a revoke tool. Monitor your wallet for unauthorized transactions and consider moving remaining funds to a new, secure wallet. Report the domain to your email provider and block it in your DNS filter. The domain remains active, so avoid revisiting under any circumstances.