spatial-airdrop[.]xyz

The domain spatial-airdrop.xyz has been identified as part of a brand impersonation scheme targeting cryptocurrency users through a fraudulent airdrop scam. Currently, the domain is offline, though prior activity indicates it was actively used to deceive victims into interacting with malicious infrastructure. The specific threat type involves luring users with false promises of token distributions, likely leading to wallet-draining attacks or credential theft. Analysis of the domain reveals it was created on June 16, 2026, and registered through GMO Internet, Inc. It resolved to the IP address 23.221.227.225 and was secured with an SSL certificate issued by GoDaddy.com. Security vendors have flagged the domain, with 5 out of 95 VirusTotal vendors detecting it as malicious. Additionally, it appears on three security blocklists and is blocked by multiple threat intelligence platforms. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its high-risk nature. At present, spatial-airdrop.xyz has been taken offline, reducing immediate exposure. However, similar domains may emerge using comparable tactics. Users are advised to verify airdrop legitimacy through official project channels before interacting with any links or providing wallet credentials. Organizations should monitor for domains registered under the same registrar or resolving to the identified IP address, as these may indicate related malicious infrastructure. Proactive blocking of known indicators of compromise, such as the domain and associated IP, is recommended to mitigate potential threats.