airdropfs[.]com

PhishDestroy identifies airdropfs.com as an active high-risk domain engaged in brand impersonation targeting cryptocurrency users. This site masquerades as a fake 'Airdrop' service to deceive victims into connecting their wallets and signing malicious transactions. The domain utilizes a drainer kit designed to siphon cryptocurrency assets under the guise of legitimate airdrop distributions, a tactic commonly associated with 'drainer scams' in the Web3 ecosystem.

This domain was flagged by 10 out of 95 VirusTotal security vendors and is blocked by Google Safe Browsing under the SOCIAL_ENGINEERING category. It resolves to IP address 8.217.144.225 and was registered through Metaregistrar BV on March 27, 2026. Despite utilizing a Let's Encrypt SSL certificate, the site exhibits clear indicators of malicious intent, including its recent creation date and active engagement in fraudulent activities. The combination of a high VirusTotal detection rate and authoritative blacklisting underscores the elevated risk posed by this domain.

As of the latest assessment, airdropfs.com remains active and accessible, posing an immediate threat to users seeking cryptocurrency airdrops. PhishDestroy recommends blocking this domain at the network level and avoiding any interaction with the site. Users who have already visited the domain should revoke any wallet connections made through the site and monitor their accounts for unauthorized transactions. While this domain is actively flagged and monitored, the risk of new variants or similar domains emerging remains high, necessitating continued vigilance and proactive threat intelligence sharing.