airdrop-demo[.]foruai[.]io

Analysis of airdrop-demo.foruai.io indicates that the domain was registered on May 08, 2024 through NameCheap, Inc. and is hosted on Google Cloud infrastructure, as evidenced by the presence of Google Cloud, Google Cloud CDN, HTTP/3, and Google Cloud Storage in the technology fingerprint. The domain resolves to IP 130.211.25.160, which belongs to AS396982 Google LLC and is geolocated in the United States. The SSL certificate is issued by Google Trust Services under the WR3 intermediate, confirming the use of Google’s managed TLS service. Nameservers alan.ns.cloudflare.com and ulla.ns.cloudflare.com point to Cloudflare’s DNS service, a common choice for fast domain resolution.

The page title returned by the server is “ForU AI – Airdrop”, matching the kit label “Airdrop Scam” and the broader classification of a crypto‑drainer operation. Gridinsoft assigned a trust score of 0/100, and the domain appears on a single external blocklist. VirusTotal records show that the site was scanned by 95 antivirus engines, none of which raised a detection at the time of scanning; this lack of detection does not constitute evidence of benign behavior. PhishDestroy has already blocked the domain, and the current operational status is offline, suggesting the site has been taken down or is no longer serving content.

Despite the offline state, the observed infrastructure—Google Cloud hosting, Cloudflare DNS, and a low trust score—aligns with patterns used by cryptocurrency‑draining campaigns that lure victims with airdrop promises. Defenders should continue to monitor the associated IP address for any re‑activation, add the domain and its IP to network deny lists, and flag any future DNS resolutions to the same nameservers as suspicious. Threat‑intel feeds should be updated to reflect the domain’s inclusion in blocklists, and SOC analysts should watch for similar “ForU AI – Airdrop” page titles or Airdrop‑kit signatures in upcoming traffic.