squad[.]defairewards[.]net

This domain is flagged for hosting an airdrop scam, a form of brand impersonation designed to deceive cryptocurrency users into interacting with fraudulent reward schemes. Analysis indicates the infrastructure was constructed to mimic legitimate token distribution events, likely aiming to harvest credentials or deploy wallet-draining scripts. The risk level is classified as elevated due to the domain’s active exploitation of trust in decentralized finance (DeFi) promotions and its prior operational status before takedown. Infrastructure analysis reveals the domain squad.defairewards.net resolved to IP address 76.76.21.98 and was registered through NameCheap, Inc. on February 21, 2026. The page title, 'DEFAI Airdrop Checker,' aligns with known tactics used in fake airdrop campaigns. Detection metrics include 6 out of 95 security vendors flagging the domain on VirusTotal, while Gridinsoft assigned a trust score of 0/100. The domain appeared on one security blocklist and was subsequently blocked by PhishDestroy. SSL certification was provided by Google Trust Services, and technologies detected include Vercel hosting with HTTP Strict Transport Security (HSTS) enabled. Current status confirms the domain has been taken offline, though residual risks may persist if associated infrastructure remains active. Mitigation steps for this threat type include verifying airdrop legitimacy through official project channels before interaction. Users should cross-reference domain registration details, such as creation date and registrar, against known legitimate sources. Security teams are advised to monitor for domains resolving to the same IP (76.76.21.98) or employing similar naming conventions (e.g., 'defairewards'). Blocklisting the domain and its associated IP at the network level can prevent further exposure. Additionally, endpoint protection should be configured to detect and alert on wallet-draining scripts or credential phishing attempts linked to fake airdrop schemes.