airdrop-walrus[.]xyz

Analysis of airdrop-walrus.xyz shows an active infrastructure supporting a fake airdrop campaign classified as a crypto drainer. The domain is registered through GMO Internet Group, Inc. d/b/a Onamae.com and resolves to the IPv4 address 13.248.169.48, which is associated with an AWS Global Accelerator endpoint located in Canada. The site presents a valid TLS certificate issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain, and HTTP requests return a 200 status code, indicating a functional web service. The domain is served by the authoritative nameservers ns5.afternic.com, ns6.afternic.com, and a verification sub‑domain (verification-gakbzzzqmt6gkcplw4efpp.ns). Reputation data shows the domain is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scans report six detections out of ninety‑one AV engines, reinforcing the malicious assessment. While the exact payload delivery method has not been publicly disclosed, the combination of registration details, hosting on a cloud accelerator, a legitimate‑looking certificate, and multiple blocklist entries suggests a coordinated effort to lure cryptocurrency users into submitting private keys or seed phrases. Defenders should block the domain at the DNS and proxy layers, monitor for outbound connections to the resolved IP, and alert users about the fake airdrop narrative. Continuous monitoring of the associated IP range and periodic re‑scanning of the domain are recommended to detect any changes in behavior or additional indicators of compromise.