edma-app[.]info

Analysis of the domain edma-app.info reveals a confirmed phishing campaign targeting MetaMask users through a fraudulent airdrop scheme. The domain was registered on February 21, 2026, via Unstoppable Domains Inc and currently resolves to the IP address 147.45.177.55, hosted under AS215540 (GLOBAL CONNECTIVITY SOLUTIONS LLP) in Canada. Infrastructure analysis indicates Cloudflare nameservers (harlee.ns.cloudflare.com and sonny.ns.cloudflare.com) were employed, alongside a Let's Encrypt SSL certificate (R13), suggesting an attempt to appear legitimate while concealing hosting origins. The page title, 'Claim Your DLUME Tokens | AurealOne,' directly references a fake airdrop, aligning with the scam type identified in the intelligence data.

While the domain is now offline, it was actively flagged by two security blocklists—PhishDestroy and ScamSniffer—and received a Gridinsoft trust score of 0/100, indicating high confidence in malicious classification. VirusTotal data shows a single detection from 93 security vendors, though this limited visibility does not diminish the confirmed phishing activity. Defenders should treat this domain as a verified threat vector for MetaMask brand impersonation.

The combination of a recent registration date, low detection counts due to takedown efforts, and the use of Cloudflare infrastructure is consistent with short-lived phishing operations designed to evade prolonged scrutiny. Organizations are advised to block the domain and IP at perimeter security controls, monitor for related domains registered through the same registrar, and alert users to the fake DLUME Tokens airdrop as a known lure. No additional page content or visual indicators are available for analysis at this time.