tac[.]airdropalerts[.]one

Analysis of tac.airdropalerts.one shows a recently registered domain created on February 21, 2026 that was used to host a crypto‑draining scam. The domain resolves to IP address 104.21.54.136, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, confirming that HTTPS was active at the time of observation.

Security‑focused services have taken action: PhishDestroy and ScamSniffer have blocked the domain, and it appears on two independent security blocklists. VirusTotal scanned the domain and recorded detections from 14 of 93 scanning engines, indicating that multiple AV products flagged the site as malicious. The current operational status is listed as offline, meaning the host is not responding to HTTP requests at the time of reporting, but the underlying infrastructure (Cloudflare IP and DNS records) remains under the control of the threat actor and could be re‑activated.

Defenders should continue to treat the domain as high‑risk: add the domain and its resolved IP to network‑level deny lists, monitor DNS for re‑registration or changes, and watch for any new activity originating from the same Cloudflare AS. Because the site was identified as a crypto‑drainer, any compromise attempts involving cryptocurrency wallets or transaction verification should be assumed malicious if they reference this domain. Ongoing vigilance is required to detect potential re‑deployment or related infrastructure that may share the same hosting provider or certificate characteristics.