allocation-grail[.]fun

This domain, allocation-grail.fun, is flagged as an active airdrop scam designed to impersonate legitimate cryptocurrency token distributions. Analysis indicates the domain targets users by presenting a fraudulent interface under the page title 'grail | Airdrop,' falsely associating itself with reputable projects to deceive victims into disclosing wallet credentials or transferring funds. The threat leverages social engineering tactics, exploiting the urgency and perceived legitimacy of airdrop events to facilitate unauthorized access to cryptocurrency assets. Infrastructure analysis reveals the domain was registered on May 27, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, with resolution to the IP address 104.21.56.235, hosted on Cloudflare’s AS13335. Detection metrics show 1 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on 3 distinct security blocklists. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common practice among threat actors to mimic secure connections. The domain remains operational, with no evidence of takedown or mitigation at the time of analysis. Users who have interacted with allocation-grail.fun are advised to immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet address. Monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. If credentials were entered, assume compromise and conduct a full security audit of associated devices. Report the domain to relevant security teams for further investigation and potential takedown efforts. No legitimate airdrop requires private key or seed phrase disclosure; any such request is indicative of fraudulent activity.