photon-phtn[.]com

Analysis of photon-phtn.com indicates it was a phishing domain associated with an Airdrop Scam kit, operational until its recent takedown. The domain was registered on September 26, 2025, through NiceNIC International Group Co., Limited, and resolved to IP address 104.21.67.59, hosted on Cloudflare's infrastructure (AS13335). Nameservers edward.ns.cloudflare.com and jocelyn.ns.cloudflare.com further confirm Cloudflare as the DNS provider. No SSL certificate was detected, increasing exposure to interception risks for visitors.

The page title 'Just a moment...' suggests a Cloudflare challenge or holding page, though the exact content served to victims remains unanalyzed. The domain appeared on two security blocklists and was actively blocked by PhishDestroy and ScamSniffer, indicating prior detection by specialized anti-phishing tools. VirusTotal scans flagged the domain as malicious by 2 of 95 security vendors, though this does not represent a comprehensive assessment. Infrastructure analysis reveals no brand-specific impersonation evidence beyond the Airdrop Scam classification, and the domain's offline status as of July 25, 2026, limits further live analysis.

Defenders should treat this domain as a confirmed phishing threat, particularly for campaigns targeting cryptocurrency or token giveaway scams. Network-level blocking of 104.21.67.59 and monitoring for related Cloudflare-hosted domains using the same nameservers is recommended. Historical DNS logs should be reviewed for connections to photon-phtn.com, and any credentials or wallet addresses associated with the domain should be flagged for potential fraud. The absence of SSL and reliance on Cloudflare infrastructure align with common phishing tactics, though no additional technical artifacts (e.g., JavaScript fingerprints, POST endpoints) are available for deeper correlation.