airdrop[.]fightfoundations[.]digital

This domain, airdrop.fightfoundations.digital, was registered on May 25, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses Cloudflare’s DNS (june.ns.cloudflare.com, nikon.ns.cloudflare.com). The authoritative name servers resolve to the Cloudflare‑hosted address 104.21.91.51, located in Canada. The site presents a page titled “Just a moment...” and returns HTTP 403, indicating that the content is currently blocked or gated. The SSL certificate is issued by Let’s Encrypt (E7), confirming the use of a free TLS service. Threat intelligence classifies the site as a high‑risk brand‑impersonation campaign targeting the Sui ecosystem with a fake airdrop lure. VirusTotal scans show seven of ninety‑one scanners flag the domain, and it appears on one public blocklist. PhishDestroy has already added the domain to its deny list. The campaign remains active, but no additional artifacts such as malware payloads or credential‑harvesting forms have been observed. Defenders should block the domain at network perimeter, monitor DNS queries for the associated IP, and update endpoint and email filters to incorporate the current blocklist entries. Ongoing analysis should focus on any changes to the HTTP response or the emergence of malicious payloads.