airdrop-bullish[.]xyz

Analysis on 25 July 2026 indicates that the domain airdrop-bullish.xyz was registered on 19 November 2025 through NiceNIC International Group Co., Limited. DNS resolution points to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The authoritative nameservers are jean.ns.cloudflare.com and karl.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate was observed for the hostname, implying that HTTPS was not configured at the time of collection. The sole visible artifact is the HTML page title “Nur einen Moment…”, which does not disclose the intended victim audience or the nature of the content.

The site is classified in the supplied intelligence as a “Crypto Scam” and more specifically as a “crypto drainer”. VirusTotal scanned the domain and 7 of 95 security vendors reported malicious behavior, supporting the suspicion of illicit activity. Gridinsoft assigned a trust score of 0 out of 100, and the domain is listed on a single external blocklist, as well as being blocked by the PhishDestroy service. Current network probes show the domain as offline, preventing further content analysis. Consequently, the exact mechanisms used to drain cryptocurrency, such as wallet‑address harvesting or malicious smart‑contract interaction, remain unverified.

The lack of an SSL certificate, combined with a low trust score and multiple vendor detections, suggests a high probability of malicious intent. Defensive actions should include adding 188.114.97.3 to deny‑list or firewall block rules, ingesting airdrop-bullish.xyz into DNS sinkhole configurations, and ensuring endpoint protection solutions reference the VirusTotal detection count. Monitoring for any future re‑registration of the same name or similar subdomains under the same registrar is also advised.