ye-airdrop[.]com

Analysis of ye-airdrop.com shows a recently registered domain (creation date February 21, 2026) that was used in a crypto‑drainer campaign and is now offline. The domain resolves to IP address 172.67.140.218, which is hosted by Cloudflare (AS13335) and geolocated to the United States. The site presented the page title "Nur einen Moment…", a German phrase meaning "Just a moment…", which is commonly employed to create a brief loading impression before redirecting victims to malicious content. The SSL certificate associated with the domain is labeled WE1, indicating a standard Cloudflare‑issued certificate without further validation details.

Independent blocklist providers PhishDestroy and ScamSniffer have both added the domain to their phishing and scam lists, confirming that external threat‑intelligence feeds recognized the infrastructure as malicious. VirusTotal reports indicate that the domain was scanned by 93 vendors, none of which raised a detection at the time of analysis; however, the absence of detections does not constitute a safety guarantee, especially given the domain's confirmed use in a crypto‑drainer operation. The domain appears on two additional security blocklists, reinforcing its reputation as hostile.

Because the site is currently taken offline, active mitigation is limited to ensuring that any cached or historic references are blocked at the network perimeter. Defenders should continue to deny DNS resolution for ye-airdrop.com, enforce URL filtering rules that match the domain and its associated IP, and monitor Cloudflare‑hosted IP ranges for similar newly registered domains. Ongoing vigilance is advised to detect re‑deployment of the same infrastructure under new domain names, and threat‑intel teams should correlate future sightings with the observed page title and SSL fingerprint to expedite identification.