pundiai[.]icu

Analysis of pundiai.icu confirms it as a phishing domain targeting MetaMask users through a fraudulent airdrop scam. The domain, registered on February 21, 2026, via Web Commerce Communications Limited (WebNic.cc), resolved to 104.21.72.66, a Cloudflare IP (AS13335) located in the US. No SSL certificate was present, and nameservers were set to ns100.webnic.cc and ns101.webnic.cc. The site displayed the page title 'Pundi AI Airdrop,' explicitly impersonating MetaMask to execute a wallet/seed phishing scheme.

Five security vendors on VirusTotal flagged the domain, and it appears on three blocklists, including PhishDestroy, MetaMask’s internal systems, and SEAL. Gridinsoft assigned a trust score of 0/100, further corroborating its malicious classification. The domain is currently offline, but defenders should treat any prior resolution to 104.21.72.66 or association with the listed nameservers as high-risk indicators. Infrastructure analysis reveals reliance on Cloudflare’s network, a common tactic to obscure hosting origins.

While the exact phishing kit remains unconfirmed beyond the 'Airdrop Scam' classification, the combination of brand impersonation, seed-phishing intent, and vendor detections provides sufficient evidence for immediate blocking. Defenders should monitor for re-registration under the same registrar or IP reuse, as threat actors frequently recycle infrastructure. No legitimate use case is known for this domain.