airdrop[.]fabrics[.]icu

The domain airdrop.fabrics.icu was registered on February 27, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently active. DNS resolution points to IP address 188.114.96.3, which belongs to AS13335 Cloudflare, Inc., and the authoritative nameservers are audrey.ns.cloudflare.com and rohin.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt (identifier E7) and serves HTTP/3 traffic, but HTTP requests return a 403 status code and the only observed page title is "Just a moment...". Threat intelligence flags the domain as a brand‑impersonation campaign targeting the Sui cryptocurrency ecosystem, categorised as a crypto scam. VirusTotal analysis shows 15 of 93 security vendors flag the domain, and it appears on one public blocklist; PhishDestroy has also listed it as blocked. Independent scoring from Gridinsoft assigns a trust score of 0 out of 100. No additional evidence such as phishing page content, credential capture forms, or malicious payloads has been disclosed, leaving the exact user‑facing tactics uncertain. Defenders should block the domain at DNS and proxy layers, add the IP address to network deny lists, and monitor for similarly named domains that target Sui users. Security awareness messaging should warn users that unsolicited Sui‑related airdrop offers are likely fraudulent, and any requests to bypass the 403 page should be treated as malicious.