airdrop[.]stacksop[.]xyz

This domain, airdrop.stacksop.xyz, was registered on February 21, 2026 and is currently listed as offline. The site served a page titled “Nur einen Moment…” and was identified as a crypto‑drainer type scam. Infrastructure analysis shows the domain resolves to the IP address 104.21.96.1, which is part of Cloudflare’s AS13335 network located in the United States. The SSL certificate presented is identified as “WE1”, indicating a likely mis‑issued or low‑trust certificate.

Reputation services have assigned a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy, which has already taken the site offline. VirusTotal scans report that two out of ninety‑three antivirus engines flag the domain as malicious, reinforcing the suspicion of malicious activity. No additional public intelligence such as OSINT feeds, Open Threat Exchange entries, or Safe Browsing alerts have been observed for this host. The limited detection footprint suggests the campaign was short‑lived or quickly mitigated.

Defenders should continue to block the resolved IP address 104.21.96.1 at network perimeter devices, enforce DNS filtering for the exact domain, and monitor for any resurgence of similar sub‑domains under the stacksop.xyz parent zone. Given the Cloudflare hosting, threat‑hunters may also consider querying Cloudflare’s abuse portal for further details on the account responsible for the host. Continuous re‑scanning of the domain on VirusTotal and other multi‑engine platforms is advised, as additional detections could emerge if the site is re‑hosted. Organizations that handle cryptocurrency transactions should treat any communication referencing “airdrop” or similar terminology with heightened scrutiny, especially if it originates from unsolicited channels.