magairdrop[.]xyz

The domain magairdrop.xyz was registered on April 21, 2026 through Namecheap Inc. The authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, indicating the use of a popular cloud DNS provider. The site resolves to IP address 216.198.79.1, which belongs to Amazon.com, Inc. (AS16509) and is located in the United States. Infrastructure analysis shows the server presents a Let’s Encrypt SSL certificate (YR2) and responds with an HTTP 307 temporary redirect, a pattern often used to forward victims to malicious payloads while preserving the original URL. The Gridinsoft trust score is 0 out of 100, reflecting a complete lack of credibility. The page title delivered to browsers reads “Make Aliens Great Again | Airdrop”, a clear attempt to mimic legitimate airdrop promotions. Threat intelligence flags the domain as part of an active brand‑impersonation campaign targeting the “Airdrop Scam” brand. Two of ninety‑five security vendors on VirusTotal have flagged the domain, and it appears on three public blocklists. It is currently blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple mitigation services have identified it as malicious. The observed kit is labeled “Airdrop Scam”, reinforcing the intent to lure users into fraudulent airdrop schemes. Defenders should add magairdrop.xyz to firewall deny lists and DNS filtering policies, and monitor for any traffic to 216.198.79.1 from internal hosts. Because the domain uses a reputable DNS provider, simple domain‑based blocking may be insufficient; network‑level controls that inspect HTTP status codes and TLS certificates are advised. Continuous monitoring of blocklist updates and VirusTotal reports is recommended to capture any changes in the domain’s reputation.