ff-airdrop[.]com

On 25 July 2026 the domain ff-airdrop.com was identified as part of an active crypto-drainer operation. The site resolves to 188.114.97.3, an address owned by AS13335 Cloudflare, Inc. and geolocated to the United States. Registration data shows the domain was created on 22 February 2026 through NiceNIC International Group Co., Limited and is served by the Cloudflare nameservers abby.ns.cloudflare.com and troy.ns.cloudflare.com. TLS termination is performed by a Google Trust Services certificate issued under the WE1 root, indicating a valid HTTPS endpoint.

HTTP probing returns a 403 status code and the only visible page title is "Just a moment…", suggesting that the front-end is either protected by Cloudflare’s challenge page or deliberately obscured. VirusTotal scans have recorded detections by 5 of 95 security vendors, confirming that the domain is recognized as malicious by multiple anti-malware engines. The activity is classified in the intelligence feed as a "Crypto Scam" and is associated with the publicly-available "Airdrop Scam" phishing kit. The kit typically lures victims with promises of free token airdrops and then harvests private keys or redirects funds to attacker-controlled wallets.

The site employs Node.js and Express on the application layer, enforces HTTP Strict Transport Security, and utilizes Cloudflare Browser Insights and HTTP/3, all of which are consistent with the infrastructure used by known crypto-drainer campaigns. The domain appears on one external blocklist and has been explicitly blocked by the PhishDestroy service. Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high-risk assessment. No additional content analysis is available beyond the generic title, so the exact phishing pages, credential-capture forms, or wallet-address placeholders have not been captured.