floki-airdrop[.]org

This domain, floki-airdrop.org, is flagged as a high-risk crypto drainer, active as of July 12, 2026. Registered on February 21, 2026, through NiceNIC International Group Co., Limited, the domain exhibits indicators consistent with cryptocurrency-related fraud. Infrastructure analysis reveals the use of Cloudflare nameservers (darl.ns.cloudflare.com and kristina.ns.cloudflare.com) and HTTP/3 protocol, which may obscure origin and complicate tracing efforts. The domain currently returns an HTTP 403 status with the page title 'Just a moment...', a response often associated with Cloudflare protection or automated filtering, though the exact content served to users remains unconfirmed. The domain appears on five security blocklists, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, indicating prior detection by multiple independent sources. A single security vendor on VirusTotal flags the domain, though the absence of broader detection does not diminish the risk given its presence on specialized blocklists targeting cryptocurrency threats. The Gridinsoft trust score of 0/100 further supports its classification as malicious. No additional details regarding the specific cryptocurrency brands, wallets, or drainer kits involved are currently available in the intelligence data. Defenders should treat this domain as an active threat vector for cryptocurrency theft. Network-level blocking is recommended, particularly for endpoints handling wallet transactions or interacting with decentralized finance platforms. Monitoring for connections to the domain, including subdomains or related IP addresses, may help identify compromised systems. Given the use of Cloudflare, defenders should also account for potential IP rotation or proxying in detection rules. The domain’s registration age (approximately five months) suggests it may remain operational for an extended period, warranting sustained vigilance.