dappradarairdrop[.]link

Analysis as of July 24, 2026 identifies dappradarairdrop.link as a high‑risk brand‑impersonation infrastructure targeting users of DappRadar. The domain was registered through NameSilo, LLC on 21 February 2026 and resolves to 104.21.72.246, an address owned by AS13335 Cloudflare, Inc. in the United States. DNS resolution is served by arvind.ns.cloudflare.com and irma.ns.cloudflare.com, indicating Cloudflare’s authoritative name‑servers. HTTP requests return a 403 status code and the page title reported by the server is “Suspected phishing site | Cloudflare”, confirming that Cloudflare is actively blocking access.

The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, which is typical for Cloudflare‑protected sites. Security‑vendor scans on VirusTotal show that 10 of 93 engines flagged the domain, reinforcing the suspicion of malicious activity. The Gridinsoft trust score is 0 / 100, and the URL appears on four external blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. The listed scam type is “Fake Airdrop”, and the domain explicitly impersonates the DappRadar brand.

The current operational state is offline; the domain has been taken down, but the infrastructure components remain observable. Uncertainty remains regarding the exact payload delivered to victims, as no page content has been captured beyond the generic Cloudflare block page. Defenders should continue to block the domain at perimeter devices, update URL filtering rules, and monitor for any re‑registration attempts or usage of the same IP address in new campaigns. Additional threat‑intel sources should be consulted for possible Indicators of Compromise (IOCs) such as request patterns, user‑agent strings, or malicious scripts that may have been served before takedown.