approvalguard[.]io

This domain, approvalguard.io, is flagged as an active phishing threat specializing in Airdrop scams, as identified by infrastructure analysis and confirmed detection by security vendors. Registered on February 21, 2026, through NameCheap, Inc., the domain resolves to IP 172.66.0.96, hosted on Cloudflare’s network (AS13335) in the United States. The site returns an HTTP 200 status, indicating an operational web server, and is protected by a Google Trust Services SSL certificate (WE1). DNS records reveal DigitalOcean nameservers and MX records pointing to mx1.privateemail.com and mx2.privateemail.com, suggesting email infrastructure is configured, a common tactic in phishing campaigns to lend legitimacy or facilitate credential harvesting. Technology detection indicates the use of Node.js with Express, Cloudflare for CDN and security, and Amplitude for analytics, alongside HTTP/3 support.

The presence of an Airdrop phishing kit is explicitly noted in threat intelligence, aligning with the domain’s high-risk classification. While only 2 of 93 security vendors on VirusTotal currently flag this domain, it appears on at least one security blocklist and is blocked by PhishDestroy. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Defenders should treat this domain as confirmed malicious infrastructure.

Immediate actions include blocking the domain and IP at network perimeter controls, monitoring for connections to 172.66.0.96 or related Cloudflare IPs, and reviewing logs for interactions with the domain’s email servers (mx1.privateemail.com, mx2.privateemail.com). Given the use of Cloudflare, traditional IP-based blocking may be less effective; DNS-level blocking or web proxy filtering is recommended. The domain’s recent registration and active status suggest it may be part of a larger, ongoing campaign targeting cryptocurrency users.