tabi-airdrop[.]website

Analysis of tabi-airdrop.website shows a recently registered domain (created 21 February 2026) that was directed to the Cloudflare address 172.67.146.17, an IP located in the United States and associated with ASN 13335 (Cloudflare, Inc.). The site presented an SSL certificate labeled WE1, indicating that transport encryption was in place but providing no further validation of ownership. VirusTotal scans recorded detections by two of ninety‑three security vendors, suggesting that at least a minority of scanners identified malicious characteristics. The domain is listed on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt and Codeesura, reinforcing the consensus that it is being used for abusive activity.

A Gridinsoft trust score of 0 out of 100 further reflects a high confidence of malicious intent. The page title returned by the server is "TABI", and the intelligence tags associate the site with a crypto‑scam campaign that impersonates the MetaMask brand. Current network checks indicate the domain has been taken offline, but historical evidence confirms its operation as a brand‑impersonation vector. Defenders should add the fully qualified domain name to DNS and URL filtering rules, ensure that any outbound traffic to the associated Cloudflare IP is logged and, where possible, blocked.

Continuous monitoring of the IP address for re‑hosting of similar payloads is advised, as Cloudflare‑hosted infrastructure can be reused for new campaigns. Organizations that rely on MetaMask for wallet interactions should reinforce user education about unsolicited airdrop offers and verify that internal security tools flag any references to this domain. Because the site’s content has not been captured, further forensic collection (e.g., web‑archive snapshots) would be valuable to confirm the exact phishing kit employed.