airdroq[.]top

This domain, airdroq.top, was actively used to impersonate the 1inch decentralized exchange platform by presenting a fraudulent Ethereum token airdrop. Victims were likely lured into connecting cryptocurrency wallets under the pretense of receiving free tokens, a common tactic to deploy crypto drainers that siphon funds once wallet permissions are granted. The site specifically targeted users familiar with 1inch, exploiting trust in the brand to facilitate unauthorized transactions and asset theft. Analysis indicates the domain was created on March 7, 2026, and registered through PDR Ltd. d/b/a PublicDomainRegistry.com. At the time of assessment, 18 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on at least one security blocklist. The domain resolved to IP address 172.67.132.14, hosted on Cloudflare’s network (AS13335), which is frequently leveraged by threat actors to obscure hosting origins and evade takedowns. The page title, 'Ethereum Token Airdrop,' further confirms the intent to deceive users into engaging with the fraudulent offer. Individuals who visited airdroq.top or interacted with its content should immediately revoke any connected wallet permissions using a trusted blockchain explorer or wallet management tool. All connected devices should undergo a full malware scan to detect potential secondary infections. Users are advised to monitor their cryptocurrency wallets for unauthorized transactions and report any suspicious activity to their wallet provider or relevant financial authorities. If personal or financial information was submitted, consider placing a fraud alert on credit files and notifying affected financial institutions.