layeredgeairdrop[.]info

The domain layeredgeairdrop.info was registered on February 21, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. Technical analysis shows the site was served behind Cloudflare, employing HTTP/3 and resolving to IP address 104.21.12.191, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are rosalyn.ns.cloudflare.com and aarav.ns.cloudflare.com, and the TLS certificate is issued by Google Trust Services under the WE1 framework, indicating a valid HTTPS handshake despite the site’s unavailability. An attempt to retrieve the homepage returned a 522 Connection timed out error, and the page title captured is "layeredgeairdrop.info | 522: Connection timed out," confirming that the service is currently offline.

Threat intelligence flags the domain as part of an Airdrop Scam kit, categorised as a crypto drainer. VirusTotal analysis recorded a single positive detection out of 93 scanning engines, and the domain is listed on one external blocklist. PhishDestroy has also added the domain to its blocklist, reinforcing the view that it is being used for malicious cryptocurrency‑related activity.

Defenders should treat any DNS resolution to 104.21.12.191 that references layeredgeairdrop.info as suspicious. Preventive controls such as URL filtering, DNS sinkholing, and endpoint web‑proxy rules should block the domain outright. Continuous monitoring of Cloudflare‑hosted IP ranges for new resolutions to the domain is advised, as the infrastructure could be re‑activated under a different sub‑domain or with altered content. Although the site is presently offline, its recent registration date, association with a known crypto‑drainer kit, and detection by security vendors suggest a high likelihood of malicious intent if the infrastructure is revived. Organizations should update threat‑intel feeds with this indicator and remain vigilant for any future activity tied to the domain or its hosting IP.