cornmon[.]xyz

Analysis of the domain cornmon.xyz indicates it was actively involved in a crypto-focused phishing campaign targeting users through a fraudulent airdrop scheme. The domain, registered on October 27, 2025, via NiceNIC International Group Co., Limited, resolved to the IP address 188.114.96.3, hosted under AS13335 (Cloudflare, Inc.) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (merlin.ns.cloudflare.com and riya.ns.cloudflare.com), a common tactic to obscure hosting origins and evade basic detection mechanisms. No SSL certificate was present, increasing the likelihood of interception or manipulation of user data. The domain was flagged by four of 95 security vendors on VirusTotal, a modest detection rate that suggests either early-stage deployment or evasion techniques.

Additional trust assessments from Scamadviser and Gridinsoft assigned scores of 1/100 and 0/100, respectively, further corroborating its malicious classification. The page title, 'Airdrop is not available in your region,' aligns with known social engineering tactics used in crypto scams to manipulate user behavior by creating a sense of urgency or exclusion. The domain appears on at least one security blocklist and was classified as an 'Airdrop Scam' phishing kit by PhishDestroy, though the exact mechanics of the kit remain unconfirmed due to the site's current offline status. Defenders should prioritize blocking this domain at the DNS and proxy levels, particularly in environments where cryptocurrency-related activity is common.

The use of Cloudflare infrastructure complicates traditional IP-based blocking, necessitating reliance on domain reputation systems and real-time threat intelligence feeds. Given the domain's registration age and the specificity of the scam type, it is plausible that additional related domains may exist or emerge, warranting proactive monitoring of newly registered domains with similar naming patterns or infrastructure.