kyotoclimate[.]xyz

Analysis of kyotoclimate.xyz shows a domain that was created on 28 December 2025 through NiceNIC International Group Co., Limited. The authoritative nameservers camilo.ns.cloudflare.com and serena.ns.cloudflare.com resolve the domain to the Cloudflare edge address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. No TLS certificate was observed, indicating the site was served over plain HTTP at the time of capture. The page title returned by the server is “Kyoto V3 Airdrop”, aligning with the intelligence‑provided classification of a crypto‑focused airdrop scam.

VirusTotal recorded seven detections out of ninety‑three scanned scanners, and the domain is listed on a single security blocklist. PhishDestroy has also taken the domain offline and marked it as blocked. The campaign is identified as employing an “Airdrop Scam” phishing kit, consistent with the reported scam type of a crypto scam. The available evidence confirms that the domain was used to lure victims with promises of a cryptocurrency airdrop, likely to harvest credentials or private keys.

Because the site is currently offline, active payloads cannot be inspected, and the exact content of the page remains unverified beyond the title. Defenders should continue to block the domain at network perimeters, update URL filtering lists with the observed IP address and nameserver information, and monitor for any re‑registration attempts or similar domains using the same registrar or Cloudflare infrastructure. Ongoing telemetry from threat‑intel feeds should be correlated with the seven VirusTotal detections to assess whether additional malicious payloads are associated with this infrastructure.