airtm[.]cfd

The domain airtm.cfd is a generic phishing site posing as a fake cryptocurrency exchange, classified as an elevated-risk scam. It does not impersonate a specific legitimate brand or deploy a known drainer kit. As of the latest verification, airtm.cfd has been taken offline, though it previously operated as a fraudulent platform designed to steal user credentials and funds.

Technical indicators confirm the suspicious nature of airtm.cfd. The domain was flagged by 1 of 95 VirusTotal security vendors and appears on 3 security blocklists, including PhishDestroy, MetaMask, and SEAL. Registered through HOSTINGER operations, UAB on November 06, 2025, it resolved to the IP address 2.57.91.91, hosted by Hostinger International Limited in Lithuania. No SSL certificate was issued, and the observed page title was 'Parked Domain name on Hostinger DNS system.' The domain used nameservers ns1.dns-parking.com and ns2.dns-parking.com, with detected technologies including Hostinger CDN, Google Analytics, and HTTP/3. Gridinsoft assigned it a trust score of 0/100.

Users who interacted with airtm.cfd should immediately change any passwords or credentials entered on the site and enable two-factor authentication on all financial and cryptocurrency accounts. Monitor accounts for unauthorized transactions and report any suspected fraud to relevant platforms. To mitigate further risk, revoke any token approvals granted to unknown or suspicious contracts using tools like Etherscan or revoke.cash. Report the domain to anti-phishing organizations such as PhishTank or the Anti-Phishing Working Group to assist in broader takedown efforts.