airdropsalerts[.]com

The domain airdropsalerts.com was registered on November 21, 2025 through Dynadot LLC and is currently resolved to the Cloudflare‑managed address 172.67.144.23, belonging to AS13335 Cloudflare, Inc. in the United States. The site’s TLS certificate is issued by Google Trust Services under the WE1 label, indicating a valid HTTPS endpoint, but the certificate alone does not imply legitimacy. The authoritative nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com confirm that the domain is fully proxied through Cloudflare, which also serves the page title “Access denied | airdropsalerts.com used Cloudflare to restrict access | airdropsalerts.com | Cloudflare”. This title suggests the site is presently inaccessible, consistent with the reported offline status.

Intelligence flags the domain as a crypto‑drainer scam, specifically employing the publicly available “Airdrop Scam” phishing kit. The kit is commonly used to lure cryptocurrency users with false airdrop promises and to harvest private keys or redirect funds. The domain appears on a single security blocklist and is listed by PhishDestroy as a malicious resource. VirusTotal analysis shows 11 of 95 scanning engines flag the domain, reinforcing the malicious classification despite the relatively low detection count.

From an infrastructure perspective, the use of Cloudflare and HTTP/3 indicates a modern hosting stack that can obscure the true origin server and provide resilience against takedown attempts. The presence of a valid Google‑issued certificate may increase user trust, while the Cloudflare proxy can hide detailed server fingerprints. No additional public blocklists, Safe Browsing entries, or OTX indicators were observed beyond the one blocklist and the PhishDestroy entry.

Defenders should treat any traffic to airdropsalerts.com as hostile. Network sensors should block outbound connections to the IP 172.67.144.23 and to the domain itself.