snapshot-hodl[.]fun

The domain snapshot-hodl.fun was registered on February 21, 2026 and is presently taken offline. Technical analysis shows that it resolves to the IP address 172.67.144.45, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented the page title “HODL Airdrop,” indicating a crypto‑focused airdrop scam, and the underlying infrastructure matches the known Airdrop Scam phishing kit.

The SSL certificate associated with the domain is identified as WE1, confirming the use of a standard TLS layer without additional validation. Reputation services flag the domain as highly risky: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically being blocked by PhishDestroy. VirusTotal analysis recorded detections from 2 of 93 scanned security vendors, reinforcing the malicious classification.

The elevated risk level is consistent with the observed indicators, and the combination of a low trust score, blocklist presence, and vendor detections suggests a deliberate attempt to lure cryptocurrency users into a fraudulent airdrop. Defenders should ensure that the IP address 172.67.144.45 and the associated ASN are added to network deny lists, enforce DNS filtering for the domain snapshot-hodl.fun, and monitor for any resurgence of the Airdrop Scam kit in related campaigns. Continuous telemetry from threat intelligence platforms should be consulted for new detections, and endpoint protection solutions should be tuned to flag the identified SSL fingerprint and the specific page title pattern to reduce exposure to similar crypto‑scam attempts.