n7845hhn23unbd73bhsj[.]xyz

The domain n7845hhn23unbd73bhsj.xyz was observed as an offline Airdrop Scam phishing site on July 24, 2026. Registration data indicates the domain was created on September 08, 2025 through NiceNIC International Group Co., Limited and is served by the Cloudflare nameservers evan.ns.cloudflare.com and shaz.ns.cloudflare.com. DNS resolution points to IP address 104.21.37.152, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate was presented, confirming the absence of HTTPS support.

The page title returned by the server is the German phrase "Nur einen Moment…", and the site is identified as employing an Airdrop Scam phishing kit. Infrastructure reputation is poor: the Gridinsoft trust score is 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy. VirusTotal analysis recorded 8 detections out of 95 scanned security vendors, indicating that multiple anti‑malware engines have flagged the domain as malicious. The combination of a zero trust score, lack of encryption, and multiple vendor detections suggests a high likelihood of malicious intent despite the current offline status.

Defenders should proactively block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions. Adding the domain to internal blocklists and monitoring for any resurrection of the host or reuse of the same IP range is recommended. Organizations should also watch for similar Airdrop Scam kits in other campaigns, as the observed kit indicates a pattern of targeting users with fraudulent token distribution promises. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related indicators of compromise.