Results reflect each source’s collection time. Zero detections do not guarantee safety. OTX references are community publications.
セキュリティシグナル
Scamadviser Warnings76/100
The Tranco rank (how much traffic) is rather low An iframe has been detected within the website The site does not allow us to analyze its content The main site has a lower ranking
Analysis indicates that the domain airdrop.ontomir.network is an active crypto drainer scam site, operational as of July 12, 2026. Infrastructure review reveals the domain is registered through NameCheap, Inc., and utilizes Cloudflare nameservers (zelda.ns.cloudflare.com and valentin.ns.cloudflare.com). The site resolves to IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. A 403 HTTP status is currently returned, though the domain remains flagged by at least one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score is 0/100, further corroborating its malicious classification. The scam type is explicitly labeled as a crypto scam, though the exact mechanics—whether a fraudulent airdrop, wallet drainer, or other scheme—are not detailed in available data. The page title 'Nur einen Moment…' suggests a temporary or transitional state, potentially indicative of a redirection or obfuscation tactic. Technologies detected include Cloudflare Browser Insights and HTTP/3, with an SSL certificate issued by Google Trust Services (WE1). Only one of 95 security vendors on VirusTotal has flagged the domain, which may reflect limited detection coverage rather than benign status. Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP (188.114.97.3) at the network level, monitoring for related subdomains or newly registered lookalike domains under the ontomir.network namespace, and alerting users to potential crypto wallet threats. Given the domain’s reliance on Cloudflare infrastructure, additional scrutiny of other Cloudflare-hosted domains with similar naming patterns (e.g., airdrop-themed) is recommended. No evidence of takedown or sinkholing has been observed, and the domain remains active as of this report.
For the registrable domain ontomir.network behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeReachable but protectedreason: Cloudflare Challenge85% confidence
AttributionCloudflaremechanism: Challengesource: Current Http Probe
Evidence layersAvailability: Reachable but protectedContent: UnknownDNS: ResolvedRegistration: Unknown
Latest HTTP observationReachable but protectedCloudflare ChallengeCloudflareChallenge85%2026-10-19 22:22:41 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:35:29 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 3 identified
Cloudflare Browser Insights
AnalyticsRUM
Performance monitoring tool that measures website speed from real users.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
