voucher-5606[.]notcolayer[.]app

Analysis of voucher-5606.notcolayer.app indicates that the domain was actively used for a crypto‑airdrop phishing campaign before being taken offline. The site presented the page title “Notcoin Airdrop”, a common lure for users seeking free cryptocurrency. Infrastructure inspection shows the domain resolved to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geographically located in the United States. No TLS certificate was observed, meaning the site operated over plain HTTP, which is consistent with many low‑cost phishing kits.

The observed kit is identified as the “Airdrop Scam” package, a publicly available template that replicates a cryptocurrency airdrop claim. Reputation services have flagged the domain on at least one security blocklist, and PhishDestroy has listed it as blocked. VirusTotal reported that 7 out of 95 scanned security vendors flagged the domain, providing additional confirmation of malicious intent. The domain currently reports an offline status, so active probing is not possible, but the historical evidence is sufficient for defensive actions.

Defenders should add the domain and its resolving IP to blocklists, monitor for any re‑registration or similar sub‑domains, and ensure that outbound traffic to the IP is denied. Since the site lacked SSL, network‑level detection of clear‑text HTTP requests can be employed. Continuous monitoring of Cloudflare‑hosted IP ranges for new domains presenting “Notcoin” or similar airdrop terminology is advised. At this stage, the primary uncertainty is whether the operators have migrated to a new infrastructure; therefore, threat‑intel feeds should be queried for any resurgence of the Airdrop Scam kit or related indicators.