airdrop[.]axt[.]fun

The domain airdrop.axt.fun was registered on March 03, 2026 through Go Daddy, LLC and is currently marked as active. It is classified as a high‑risk cryptocurrency drainer and appears on the PhishDestroy blocklist. The site returns HTTP 403 for the home page, which is titled “Home”, and the SSL certificate is issued by Google Trust Services under the WE1 profile. Infrastructure analysis shows the domain resolves to 172.66.153.159, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS is served by the Cloudflare nameservers alexia.ns.cloudflare.com and gerald.ns.cloudflare.com. The web stack is identified as Node.js using Ant Design, UmiJs, and is protected by HSTS, Cloudflare Browser Insights, and HTTP/3. Threat intelligence indicates the site is being used for a cryptocurrency draining campaign. VirusTotal reports three detections out of ninety‑five scanners, and Gridinsoft assigns a trust score of 0 out of 100. The domain is listed on one additional security blocklist, reinforcing the high‑risk assessment. Because the server returns a 403 response, the exact malicious payload or landing page content cannot be confirmed, leaving the precise attack vector uncertain. Defenders should block airdrop.axt.fun at the DNS and proxy layers, and consider blacklisting the associated IP address 172.66.153.159. Monitoring for outbound connections to the resolved Cloudflare IP range can help detect compromised clients. Email and web filtering rules should be updated to flag any references to “airdrop” or “axt.fun” in URLs or attachments. Continuous re‑scanning of the domain with sandbox services is advised to capture any changes in payload delivery.