asflnlig[.]shop

On 24 July 2026 the domain asflnlig.shop was observed to be taken offline. The only HTTP response captured was a 525 error indicating an SSL handshake failure, and the site presented no valid TLS certificate. Infrastructure analysis shows the domain resolves to the IP address 172.67.142.198, which belongs to Cloudflare, Inc. (ASN 13335) and is geolocated in the United States. Both authoritative name servers, anna.ns.cloudflare.com and arch.ns.cloudflare.com, are Cloudflare‑operated, confirming that the attacker leveraged Cloudflare’s CDN and DNS services to hide the true hosting environment. Threat intelligence flags the site as an “Airdrop Scam” – a known phishing kit that typically lures victims with promises of free cryptocurrency airdrops.

The kit identification is derived from the intelligence feed and does not rely on visual inspection of the page. VirusTotal reports that 2 out of 95 scanning engines have marked the domain as malicious, providing independent corroboration of its illicit nature. The domain appears on a single public blocklist, PhishDestroy, which has actively blocked it. Additional reputation metrics are poor: Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of legitimacy.

Given the current offline state, no further content can be examined, and the exact landing page structure remains unknown. Nevertheless, the combination of a Cloudflare‑hosted IP, a missing TLS certificate, a failure to complete the SSL handshake, and the presence on a phishing blocklist strongly suggests that the domain was intended for credential‑harvesting or token‑theft campaigns. Defenders should continue to enforce network‑level deny rules for the IP 172.67.142.198 and the domain name, monitor for any re‑registration or similar aliases, and consider adding the domain to internal blocklists. Ongoing threat‑intel monitoring is advised to detect possible re‑use of the same kit or related infrastructure in future campaigns.