airdrop[.]cyclenetwork[.]io

The domain airdrop.cyclenetwork.io was observed delivering a web page titled "Cycle Network - Chainless Liquidity Abstraction via Secure and Verifiable Chain Abstraction". The page responded with HTTP 200 and is currently reachable. The site is classified under the crypto_drainer threat category and assigned a high risk level. Its status is reported as active as of 2026-07-12.

Infrastructure analysis shows the domain resolves to IP 216.150.1.1, which belongs to the Amazon.com, Inc. network (AS16509) and is geolocated in the United States. The domain was registered through Name.com, Inc. on 2023-09-08. DNS resolution uses four name servers (ns1qsy.name.com, ns2fkr.name.com, ns3dgr.name.com, ns4fmw.name.com). A TLS certificate issued by a widely‑trusted certificate authority is present and the connection enforces HSTS, indicating a modern TLS setup. The hosting environment appears to employ a content delivery network and analytics capabilities, as indicated by the detection of generic CDN and analytics technologies.

Threat intelligence indicates that the site has been flagged by one out of ninety‑five VirusTotal scanners, and it appears on a single external blocklist. PhishDestroy has listed the domain as blocked. The Gridinsoft trust score is 0 out of 100, reinforcing a poor reputation. The combination of a cryptocurrency‑related page title, a low trust score, and the classification as a crypto drainer supports the high‑risk assessment despite the limited detection count on public scanners.

Defenders should treat airdrop.cyclenetwork.io as a malicious endpoint. Immediate mitigation steps include adding the domain and its resolving IP address to network deny lists, enabling DNS sinkholing for the associated name servers, and monitoring outbound connections for traffic to the identified IP range. Continuous re‑evaluation is advised, as additional detections may emerge on broader threat feeds.