airdrop-zigzag[.]xyz

The domain airdrop-zigzag.xyz has been identified as a brand impersonation threat specifically targeting cryptocurrency users through a fake airdrop scheme. Currently, this domain is offline, but prior activity indicates malicious intent to deceive victims into interacting with fraudulent crypto distribution pages. Analysis indicates this domain was flagged by 4 of 95 security vendors on VirusTotal, suggesting detection by multiple threat intelligence sources. Infrastructure analysis reveals the domain was registered through GMO Internet, Inc. on June 17, 2026, and resolves to the IP address 184.86.103.159. The SSL certificate is issued by GoDaddy.com, and the domain appears on three security blocklists. Additional technical indicators include a Gridinsoft trust score of 0/100 and blocking by MetaMask, PhishDestroy, and SEAL. Current status confirms the domain has been taken offline, though similar threats may reemerge under different domains. Organizations and individuals are advised to block the domain and associated IP address in perimeter security controls. Users should verify all cryptocurrency airdrop offers through official project channels only, avoiding unsolicited links or promotions. Security teams should monitor for related domains registered through the same registrar or resolving to the same IP range.