nft-airdrop[.]eu[.]org

Analysis of the domain nft-airdrop.eu.org indicates it was registered on February 21, 2026 and is currently hosted on an Amazon Web Services infrastructure (AS16509, Amazon.com, Inc.) in the United States, resolving to IP address 199.59.243.228. The domain is served through the sole nameserver 11776.bodis.com and presents an SSL certificate rated R10. Intelligence sources classify the site as a crypto scam employing an Airdrop phishing kit, and the page title returned by the server is exactly "nft-airdrop.eu.org".

The infrastructure has been flagged by three independent security blocklists—PhishDestroy, MetaMask, and SEAL—and appears on three broader security blocklists, confirming its malicious reputation within the community. VirusTotal reports indicate the domain was scanned by 95 vendors with no detections, though the lack of detections does not constitute proof of legitimacy. The site’s current HTTP status is offline, and the risk level is listed as "under investigation".

Defenders should treat any traffic to nft-airdrop.eu.org as suspicious, block the domain at perimeter defenses, and monitor for any related command-and-control patterns or credential harvesting attempts linked to the associated IP range. Given the recent registration date and the use of a known airdrop scam kit, the domain is likely part of a broader campaign targeting cryptocurrency holders, and continued observation for reuse or reactivation is recommended.