Analysis indicates that the domain airdrop.ten.claims is an active brand impersonation campaign targeting users of the Sui blockchain platform. The domain resolves to the IP address 188.114.97.3, which is associated with infrastructure commonly used to host phishing sites. The page title, 'TEN Airdrop,' aligns with tactics observed in cryptocurrency airdrop scams, where victims are lured into connecting wallets or disclosing credentials under the guise of a token distribution event. The domain is registered through Cloudflare, Inc., and employs Cloudflare-hosted technologies, including HTTP/3, which may complicate takedown efforts or attribution. As of July 12, 2026, the domain remains active and is flagged by multiple security vendors. Eight of ninety-five security engines on a widely used scanning platform detect the domain as malicious, and it appears on two security blocklists. The domain has also been identified by at least two independent detection systems specializing in phishing and scam mitigation. A trust score of 0/100 further supports the assessment of high risk. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the domain's malicious intent. The specific phishing kit in use has not been publicly detailed, but the combination of airdrop-themed branding, Sui impersonation, and the use of Cloudflare infrastructure is consistent with campaigns designed to harvest cryptocurrency wallet credentials or private keys. Defenders should treat this domain as a confirmed threat and prioritize blocking or monitoring access to it. Users encountering this domain should avoid interacting with it, particularly any prompts to connect wallets or input sensitive information. Further investigation into the hosting provider and registrar may yield additional indicators of compromise or related infrastructure.
DOM Analysisanalyzed 2026年3月24日score 78/1001 brand signal
Submitted URLhttp://airdrop.ten.claims/
Favicon Hash
ICANN OVERSIGHTRegistration: ten.claims
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For the registrable domain ten.claims behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Certificate fingerprintd5720d2719ade67798b49f30f39efd0a0c8101f57b7dbdd75c7c87e4f2e75142Certificate names · 1 SANs
ten.claims
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationRedirectingHTTP redirect observed80%2026-10-19 22:41:16 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:41:16 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 2 identified
Cloudflare
CDN
Web infrastructure and security company providing CDN, DDoS mitigation, and DNS services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
