airdrop[.]nexchainglobal[.]xyz

The domain airdrop.nexchainglobal.xyz was registered on February 21, 2026 through NameSilo, LLC and is currently resolved to the IPv6 address 2606:4700:3032::6815:4f0e, which belongs to Cloudflare’s AS13335 network in the United States. The authoritative nameservers patryk.ns.cloudflare.com and aria.ns.cloudflare.com indicate that the site is hosted behind Cloudflare’s edge platform, with Cloudflare Browser Insights and HTTP/3 observed in the TLS handshake. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS configuration despite the malicious purpose. Passive scans show the site returning HTTP 403 for the root request, and the only visible page title is the German phrase “Nur einen Moment…”.

The content has been classified as a “Fake Airdrop” crypto‑drainer, a common social‑engineering lure that promises free token distributions to harvest private keys or wallet credentials. The domain appears on a single security blocklist and has been added to PhishDestroy’s blocklist, reflecting community detection of the malicious activity. VirusTotal analysis recorded five detections out of ninety‑three scanned engines, reinforcing the suspicion of malicious intent. No additional threat intelligence sources such as OTX or Safe Browsing are cited, leaving the broader campaign context uncertain.

The limited exposure window—approximately five months from registration to the July 24, 2026 report—suggests rapid deployment and takedown. Defenders should block both the domain and its associated IPv6 address at perimeter filters, enforce DNS sinkholing for the domain, and monitor for any TLS certificates issued by Google Trust Services that reference the same CN pattern. Incident response teams should also inspect logs for outbound connections to Cloudflare edge nodes matching the observed nameservers, as compromised clients may attempt to contact the site before it was taken offline.