airdrop-0gfoundatlon[.]xyz

The domain airdrop-0gfoundatlon.xyz was registered on 22 September 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 104.21.65.22, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative nameservers are Cloudflare‑managed (damien.ns.cloudflare.com and kallie.ns.cloudflare.com), indicating the operator is leveraging Cloudflare’s CDN and DNS services to hide the true origin of the site. Public scans show that eight of ninety‑five VirusTotal security vendors have flagged the domain as malicious, and the domain appears on a single external blocklist. Independent threat‑intel sources such as PhishDestroy have also listed it as a malicious entry.

The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of a high‑confidence threat. No TLS certificate is presented; an HTTPS request returns no certificate, which is consistent with the observed page title “Just a moment…” returned by the HTTP response. The site is currently taken offline, and no active HTTP service was observed at the time of analysis. The intelligence categorizes the activity as a “crypto drainer” scam, a subtype of cryptocurrency fraud that typically lures victims into sending digital assets to an attacker‑controlled address.

Because the domain’s content has not been captured, the exact payload or phishing flow remains unknown, but the combination of a Cloudflare‑hosted endpoint, low trust score, multiple vendor detections, and blocklist inclusion strongly suggests a malicious infrastructure designed to harvest crypto payments. Defenders should block the domain and its resolving IP at network perimeters, add the associated nameservers to deny‑list rules, and monitor for any new sub‑domains or similar Cloudflare‑hosted domains created by the same registrar. Continuous feed ingestion from VirusTotal, PhishDestroy, and other blocklists will help surface future re‑activations.