mercury-airdrop[.]org

Analysis of mercury-airdrop.org shows a newly registered domain created on 21 February 2026 using Global Domain Group LLC as registrar. The site resolves to 172.67.179.237, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. An SSL certificate issued by Google Trust Services under the WE1 intermediate chain secures the connection, indicating normal TLS deployment but not mitigating malicious intent. The HTTP response code is 200 and the page title reads “Mercury - AI-Based Web3 Collaboration Tool | $35,000 Airdrop”, matching the known “Fake Airdrop” scam type.

VirusTotal reports that 4 of 95 security vendors have flagged the domain, and three independent blocklists (PhishDestroy, MetaMask, SEAL) already list it as malicious. The site is currently taken offline, but historical evidence shows deployment of an Airdrop Scam phishing kit, consistent with the observed page title and the description of a fake $35,000 airdrop targeting cryptocurrency users. Cloudflare Browser Insights and HTTP/3 are detected, reflecting standard Cloudflare services rather than specialized malicious infrastructure. The Gridinsoft trust score of 0/100 further confirms the domain’s low credibility.

Defenders should block the domain at perimeter firewalls and DNS filters, monitor for any residual traffic to 172.67.179.237, and add the domain hash to internal IOC lists. Because the site is offline, immediate containment is feasible, but threat actors may reuse the same infrastructure for future campaigns; continuous observation of the associated IP range and Cloudflare nameservers (roan.ns.cloudflare.com, ursula.ns.cloudflare.com) is recommended. Attribution remains limited to the observed kit and blocklist entries; no further details on operator identity are available.