airdrop[.]ontomir[.]network

Analysis indicates that the domain airdrop.ontomir.network is an active crypto drainer scam site, operational as of July 12, 2026. Infrastructure review reveals the domain is registered through NameCheap, Inc., and utilizes Cloudflare nameservers (zelda.ns.cloudflare.com and valentin.ns.cloudflare.com). The site resolves to IP address 188.114.97.3, which is part of AS13335 (Cloudflare, Inc.) located in the United States. A 403 HTTP status is currently returned, though the domain remains flagged by at least one security blocklist and is actively blocked by PhishDestroy. The Gridinsoft trust score is 0/100, further corroborating its malicious classification. The scam type is explicitly labeled as a crypto scam, though the exact mechanics—whether a fraudulent airdrop, wallet drainer, or other scheme—are not detailed in available data. The page title 'Nur einen Moment…' suggests a temporary or transitional state, potentially indicative of a redirection or obfuscation tactic. Technologies detected include Cloudflare Browser Insights and HTTP/3, with an SSL certificate issued by Google Trust Services (WE1). Only one of 95 security vendors on VirusTotal has flagged the domain, which may reflect limited detection coverage rather than benign status. Defenders should treat this domain as high-risk. Immediate actions include blocking the domain and its resolving IP (188.114.97.3) at the network level, monitoring for related subdomains or newly registered lookalike domains under the ontomir.network namespace, and alerting users to potential crypto wallet threats. Given the domain’s reliance on Cloudflare infrastructure, additional scrutiny of other Cloudflare-hosted domains with similar naming patterns (e.g., airdrop-themed) is recommended. No evidence of takedown or sinkholing has been observed, and the domain remains active as of this report.