airdrop[.]nodeops[.]asia

Analysis of airdrop.nodeops.asia shows a newly registered domain created on February 21, 2026 that was used to promote a fraudulent crypto airdrop. The domain resolves to IP address 104.21.24.227, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Registration was handled through Web Commerce Communications Limited operating as WebNic.cc, and the authoritative nameservers listed are ns100.webnic.cc and ns101.webnic.cc. The site was observed on two external blocklists, specifically PhishDestroy and ScamSniffer, indicating that security vendors have already taken mitigation steps.

VirusTotal scans report that 12 of 93 participating security vendors flagged the domain as malicious, reinforcing the suspicion of abuse. The SSL certificate presented is identified as WE1, a generic certificate often associated with free or low‑cost issuance, offering no indication of legitimate ownership. Gridinsoft’s trust scoring system assigns the domain a score of 0 out of 100, reflecting an extreme lack of trustworthiness. The domain’s current operational status is offline, which suggests the malicious campaign may have been taken down or is in the process of being dismantled.

Defenders should continue to block the domain at DNS and web‑filter layers, add the associated IP address to network‑level deny lists, and monitor any related Cloudflare edge nodes for potential re‑use. Because the underlying content has not been publicly archived, further forensic collection of page titles, payloads, or redirect behavior is not available, leaving the exact phishing page details uncertain. Ongoing vigilance is recommended, especially for organizations that have previously communicated with users about crypto airdrops, to prevent credential harvesting or wallet compromise stemming from similar impersonation attempts.