audius[.]trade

Analysis on July 22, 2026 indicates that the domain audius.trade was registered on March 22, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the Cloudflare‑owned address 172.67.162.154, which is geolocated to Canada. The authoritative nameservers dayana.ns.cloudflare.com and decker.ns.cloudflare.com confirm that the infrastructure is protected by Cloudflare. No SSL certificate was observed, implying that the site operated over plain HTTP. Service fingerprinting detected a Plesk control panel, PHP runtime, and support for HTTP/3, all typical of a commodity hosting environment.

The only page title retrieved before the site was taken offline reads “Airdrop 3 Artists | Audius”. This title together with the classification “Crypto Scam” and the identification of an “Airdrop Scam” phishing kit suggests that the site was used to lure cryptocurrency‑related giveaways. VirusTotal scans recorded four detections out of ninety‑five submitted security vendors, reinforcing the malicious assessment. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service. Independent scoring from Gridinsoft assigned a trust rating of 0 out of 100, indicating no confidence in the site's legitimacy.

Because the site is currently offline, direct interaction is not possible, but the observed indicators—recent registration, Cloudflare hosting, lack of TLS, low trust score, and multiple vendor detections—are consistent with a newly deployed phishing infrastructure targeting crypto users. Defenders should continue to block the domain at perimeter filters, monitor for any resurrection of the host or related sub‑domains, and add the associated IP address to deny lists. Threat hunters should also query threat‑intel feeds for the “Airdrop Scam” kit to uncover potential campaign overlaps.