airdropsalerts[.]app

Analysis indicates that airdropsalerts.app is presently offline but was previously identified as a crypto‑draining scam leveraging the Airdrop Scam phishing kit. The domain was registered through Cloudflare, Inc., and its authoritative name servers are brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, both belonging to Cloudflare’s network. DNS resolution points to IP address 198.18.2.23, which is allocated to AS13335 Cloudflare, Inc. in the United States. The site employed Cloudflare’s edge services, including HTTP/3, and presented an SSL certificate issued by Google Trust Services under the WE1 trust anchor, indicating a valid TLS handshake at the time of observation.

The page title returned by the server was “Access denied | airdropsalerts.app used Cloudflare to restrict access | airdropsalerts.app | Cloudflare,” suggesting that access was intentionally blocked, likely after detection by defensive controls. The domain appears on one security blocklist and has been flagged by the PhishDestroy project. VirusTotal scans recorded 14 of 95 security vendors labeling the domain as malicious, reinforcing the suspicion of malicious intent. The classification in the intelligence set lists the scam type as “Crypto Scam,” consistent with the observed use of a crypto‑drainer kit.

While the domain is currently taken offline, the infrastructure—namely the Cloudflare‑hosted IP and the associated name servers—remains reusable for future campaigns. Defenders should therefore add both the domain name and the resolved IP address to outbound and inbound filtering rules, monitor for any re‑registration of the same name servers, and consider extending blocklist coverage to include the identified Airdrop Scam kit signatures. Continuous re‑evaluation of the IP reputation is advised, given Cloudflare’s shared hosting model, to detect any resurgence of malicious activity originating from the same address space.