airdrop[.]bluwhalle[.]com

On 24 July 2026 analysts observed that the domain airdrop.bluwhalle.com is currently offline but retains infrastructure indicative of a crypto‑draining operation. The domain was registered through Name SRS AB and created on 21 October 2025. DNS resolution points to 172.67.223.108, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative nameservers, heidi.ns.cloudflare.com and jay.ns.cloudflare.com, are Cloudflare‑managed.

No SSL certificate is presented; an HTTPS request returns no certificate, which is consistent with the observed “Just a moment…” page title returned by the server. Scamadviser assigns a trust score of 35 / 100, reflecting low credibility. The site is listed on a single security blocklist and has been actively blocked by the PhishDestroy network. VirusTotal analysis shows that one out of ninety‑five scanning engines flagged the domain as malicious, reinforcing the suspicion of malicious intent despite the low detection count.

The intelligence categorizes the activity as a “Crypto Scam,” specifically a crypto drainer that attempts to exfiltrate cryptocurrency assets from victims. No additional behavioral data, such as payload samples or victim reports, are available, leaving the exact technique and victim profile uncertain. Defenders should continue to block the domain at perimeter and DNS layers, monitor traffic to the associated Cloudflare IP for anomalous cryptocurrency‑related activity, and consider adding the address to internal threat‑intel feeds. Ongoing observation of the domain’s DNS records is advised in case the operators reactivate the site or shift to new infrastructure.