expeditionpics[.]xyz

expeditionpics.xyz is flagged as an inactive malicious site that was observed hosting a page titled "Expedition NFT Giveaway". The page title, combined with the classification of the underlying phishing kit as an "Airdrop Scam", suggests the site was intended to lure victims with a fraudulent NFT airdrop promise. The domain was registered on 24 February 2026 through NiceNIC International Group Co., Limited and uses Cloudflare’s DNS service (dawn.ns.cloudflare.com, titan.ns.cloudflare.com). DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., located in the United States.

No TLS certificate was presented; the site operated without HTTPS. VirusTotal records show that two of ninety‑three scanning engines flagged the domain, indicating some detection of malicious behavior. The domain is listed on a single public blocklist, PhishDestroy, confirming that at least one security provider has taken mitigation action. As of the report date, the site is taken offline, and no live HTTP response is available for further content analysis.

Consequently, the exact page markup, form fields, or redirect behavior remain unknown. Defenders should add the domain to deny‑list rules, monitor for any re‑hosting on alternative IP ranges, and consider extending detection signatures to include similar "Expedition NFT Giveaway" page titles. Ongoing observation of Cloudflare‑hosted domains registered through the same registrar may help identify future campaigns that reuse the same infrastructure. The lack of SSL and the short lifespan of the domain are typical of fast‑flux or throwaway phishing operations, reinforcing the need for rapid blocklist updates.