overlay-airdrop[.]com

Analysis of overlay-airdrop.com indicates a recently registered (21 Feb 2026) domain hosted behind Cloudflare’s network (AS13335) and resolving to IP 104.21.63.105. The site presents a Cloudflare challenge page with the title “Just a moment…”, returning HTTP 403, which suggests the origin server is protected by Cloudflare’s security layer. The domain is registered through Key‑Systems GmbH and uses a Google Trust Services / WE1 SSL certificate, confirming a valid TLS endpoint. Reputation data shows a Gridinsoft trust score of 0/100 and inclusion on a single security blocklist. PhishDestroy has already blocked the domain, and three of ninety‑three VirusTotal scanners flagged it as malicious. AlienVault OTX lists the domain in one threat‑intel pulse. The identified scam type is a crypto drainer, consistent with the high‑risk rating. Evidence for active malicious behavior is limited to the infrastructure and reputation signals; the actual payload or phishing page content has not been publicly disclosed beyond the generic challenge title. Consequently, the precise mechanism of the crypto‑draining operation remains uncertain. Defenders should treat overlay‑airdrop.com as a high‑confidence indicator of a crypto‑drainer campaign. Immediate actions include adding the domain to outbound and inbound blocklists, monitoring DNS queries for the associated Cloudflare IP range, and enforcing TLS inspection where possible. Continuous threat‑intel feeds should be consulted for any emergence of payload samples or victim reports.