primaldrop[.]info

The domain primaldrop.info is currently offline but its historical infrastructure indicates a high‑risk crypto drainer operation targeting Coinbase users. The site was registered on 11 December 2025 through Name.com, Inc and is hosted on the IP address 91.214.78.65, which belongs to AS205775 (NEON CORE NETWORK LLC) in the Netherlands. Four authoritative nameservers—ns1crv.name.com, ns2dqr.name.com, ns3gxy.name.com, and ns4cfn.name.com—were configured, suggesting a deliberately distributed DNS setup. No TLS certificate was observed, meaning the site served traffic over plain HTTP only.

The page title returned by the server was “Primal Airdrop | Phase 1”, aligning with the phishing kit identified as an “Airdrop Scam” and the Angel Drainer payload used for wallet/seed credential harvesting. The campaign explicitly impersonates Coinbase, as indicated by the brand target field, and employs a wallet/seed phishing technique to exfiltrate private keys. Reputation data show the domain appears on one security blocklist and has been blocked by PhishDestroy. AlienVault OTX lists the domain in three separate threat‑intel pulses, confirming community awareness of its malicious use.

VirusTotal analysis recorded detections from 13 of 95 scanning engines, reinforcing the malicious classification. Although the site is no longer reachable, defenders should continue to monitor the associated IP, ASN, and the four nameservers for any re‑use, and enforce strict blocking of the domain and its infrastructure in network filters. Users of Coinbase should be warned about unsolicited “airdrop” offers that request seed phrases, and incident response teams should treat any credential submissions to this domain as compromised. Further investigation is required to determine whether the nameservers are being leveraged for other phishing or drainer campaigns, but the existing evidence already warrants a high‑risk rating and immediate defensive action.