vvv[.]airdropalerts[.]one

Analysis indicates that the domain vvv.airdropalerts.one was registered on 21 February 2026 and is currently taken offline. The domain resolves to the IP address 172.67.138.242, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Reputation services have flagged the domain as malicious: two independent blocklists contain the entry, and the PhishDestroy and ScamSniffer filters actively block it. VirusTotal reports that 16 of 93 scanning engines label the domain as malicious, reinforcing the suspicion.

The Gridinsoft trust score is 0 out of 100, indicating a complete lack of confidence in the site’s legitimacy. The SSL certificate presented is identified only as “WE1”, providing no additional verification of the operator’s identity. The classified scam type is a crypto scam, specifically a crypto drainer, which typically attempts to exfiltrate cryptocurrency assets from unsuspecting victims. No public page title or content snapshot is available, so further forensic capture would be required to fully characterize the payload delivery mechanism.

Given the use of Cloudflare’s reverse proxy service, the underlying server location may be concealed, complicating attribution. Defenders should add vvv.airdropalerts.one to domain blocklists, deny outbound connections to its IP address, and monitor for any related command‑and‑control traffic. Continuous observation of the associated IP range and rapid remediation of any internal references are recommended to mitigate potential exposure.