birbdrop[.]xyz

This domain, birbdrop.xyz, was registered on February 21, 2026, through Eranet International Limited and is associated with a crypto airdrop scam impersonating Revolut. Analysis indicates the domain resolved to IP 188.114.96.3, hosted on Cloudflare infrastructure (AS13335) in the US, with no SSL certificate detected. The page title, 'Moonbirds Airdrop,' suggests a fraudulent cryptocurrency giveaway, a common tactic in crypto scams. The domain is currently offline, but prior scans by security vendors flagged it as malicious, with 3 of 95 vendors on VirusTotal detecting it.

It appears on two security blocklists and is blocked by PhishDestroy and ScamSniffer, confirming its use in phishing operations. Infrastructure analysis reveals Cloudflare nameservers (ullis.ns.cloudflare.com, vick.ns.cloudflare.com), a frequent choice for threat actors to obscure hosting origins. The absence of SSL further reduces legitimacy, as modern financial services typically enforce HTTPS. While the domain is offline, defenders should treat any prior or future resolutions of this domain as high-risk.

Historical WHOIS data, if available, may provide additional attribution details, but the registrar and hosting provider have not issued public takedown notices. Security teams should monitor for re-registration or DNS changes, as domains tied to crypto scams often resurface under similar names. No evidence links this domain to legitimate Revolut services, and the reported scam type aligns with known airdrop fraud patterns targeting cryptocurrency users.