jdudkcjfu737[.]top

Analysis conducted on July 24, 2026 identifies jdudkcjfu737.top as an offline infrastructure associated with a fake Discord airdrop campaign. The domain was registered on February 27, 2026 through NameSilo, LLC and uses Cloudflare’s authoritative nameservers isla.ns.cloudflare.com and razvan.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. No TLS certificate is present, indicating that the site was served over HTTP only. The sole page discovered during capture carried the title “Phase 2 Distribution,” consistent with the declared scam type of a “Fake Airdrop.” VirusTotal uploaded a sample of the site and recorded a single positive detection out of 93 scanning engines, confirming that at least one vendor identified malicious behavior.

The domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reflecting community consensus of its fraudulent nature. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the low credibility rating. Evidence does not disclose the exact content of the landing page, login flow, or any credential‑harvesting mechanisms because the site was taken offline before a full crawl could be completed. Consequently, the full scope of the attack vector remains uncertain, as does the presence of any additional payloads or redirect chains.

Defenders should add jdudkcjfu737.top and its resolving IP 188.114.97.3 to block lists at network perimeter and endpoint security layers. Monitoring for new domains that resolve to the same Cloudflare IP range or that reuse the “Phase 2 Distribution” title can help detect replications of this campaign. Users of Discord should be warned that unsolicited airdrop offers are not issued by the official Discord service, and any request to enter credentials or wallet information should be rejected.