airdrop-x[.]xyz

The domain airdrop-x.xyz was identified as a brand impersonation threat specifically targeting users of airdrop scams. This domain was designed to mimic legitimate airdrop platforms, likely aiming to trick visitors into connecting their wallets or providing sensitive information, effectively serving as a crypto drainer. The threat type is brand impersonation with a focus on credential theft and asset draining.

Technical indicators for airdrop-x.xyz include a VirusTotal score of 2/95 security vendors flagging the domain, indicating some but not widespread detection. The domain was registered through GMO Internet, Inc. and resolves to IP address 150.95.255.38. It was created on July 08, 2025, and its SSL certificate was issued by GoDaddy.com, Inc. via the Go Daddy Secure Certificate Authority - G2. The domain appears on 1 security blocklist and is not listed on Google Safe Browsing (GSB) as malicious, though the blocklist presence suggests some recognition of its harmful intent.

As of the latest intelligence, airdrop-x.xyz is offline, meaning the hosting or domain has been taken down, likely due to abuse reports or registrar intervention. The response actions have effectively neutralized the immediate threat, but users should remain vigilant as similar domains may reappear. The remaining risk is low for those who do not seek out airdrop opportunities, but anyone who previously visited the site should monitor their crypto wallets and accounts for unauthorized activity. Always verify airdrop URLs through official channels and avoid connecting wallets to unknown sites.