airdrophubs[.]org

On 7 April 2026 the domain airdrophubs.org was registered through IONOS SE and immediately pointed to Cloudflare’s network with the IP address 104.21.5.202 located in Canada. The domain uses the Cloudflare nameservers lilith.ns.cloudflare.com and pete.ns.cloudflare.com and presents a Google Trust Services / WE1 SSL certificate, indicating a valid TLS termination. The publicly visible page title reads “Digital Money Market funding system offers a structured airdrop campaign designed to earn tokens by completing simple and non-technical tasks,” classifying the site as a fake airdrop operation that aims to lure cryptocurrency users into surrendering private keys or sending funds.

Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, currently listed by PhishDestroy. VirusTotal scans have returned six positive detections out of ninety‑four vendors, confirming that multiple threat intelligence engines recognize the site as malicious. An MX record is configured pointing to “_dc-mx.0c13ab2cfc4d.airdrophubs.org” with priority 0, suggesting potential use for email harvesting or delivery of malicious payloads.

The infrastructure is now taken offline, limiting immediate interaction, but the combination of a fresh registration, Cloudflare hosting, low trust rating, and the fake airdrop narrative indicates a classic crypto drainer campaign. Defenders should add airdrophubs.org to blocklists, monitor for any residual DNS or SMTP activity, and instruct users to disregard unsolicited airdrop promises that reference digital money market funding. Continuous watch of the IP 104.21.5.202 and associated Cloudflare zones is advised, as the actors may repurpose the same hosting for future campaigns.