airdropwen[.]xyz

The domain airdropwen.xyz has been identified as a confirmed Airdrop Scam and is currently offline. This domain impersonates a legitimate airdrop service, potentially misleading users into sharing sensitive information or financial details.

Infrastructure analysis reveals that airdropwen.xyz is flagged by 5 of 95 VirusTotal vendors, indicating a moderate level of detection among security providers. The domain is registered through GMO Internet, Inc., and resolves to the IP address 150.95.255.38. It was created on June 03, 2025, and appears on 3 security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt. The Scamadviser trust score for this domain is 11 out of 100, and the Gridinsoft trust score is 0 out of 100, both indicating a high level of suspicion. The domain has been noted in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious nature. Technologies detected on the domain include Node.js, Envoy, Express, HSTS, and Akamai, suggesting a sophisticated infrastructure designed to evade detection and enhance credibility.

The domain airdropwen.xyz is currently offline, but the potential for it to be reactivated remains. Organizations and individuals are advised to remain vigilant and avoid any engagement with this domain. Security teams should monitor for any signs of reactivation and consider implementing DNS-based blocking or firewall rules to prevent access. Additionally, users should be educated on the signs of airdrop scams and encouraged to verify the legitimacy of any airdrop offers through official channels.