airdrop[.]paintswap[.]pro

Analysis of airdrop.paintswap.pro shows a domain that has been taken offline but retains indicators of malicious activity consistent with a crypto‑drainer scam. The site resolved to the IP address 172.67.198.10, which is owned by Cloudflare, Inc. (AS13335) and is geolocated to the United States. Registration was performed through Cloudflare, Inc., a common choice for fast‑flux and abuse operators because it masks the true registrar and provides flexible DNS controls. The domain presented the page title "Just a moment..." and did not serve an SSL certificate, indicating an unencrypted HTTP response at the time it was captured. A Gridinsoft trust score of 0 out of 100 was recorded, placing the domain at the absolute lowest confidence level for legitimacy.

VirusTotal reported one positive detection out of ninety‑five submitted security vendors, confirming that at least a single vendor flagged the host as suspicious. Additionally, the domain appears on a single security blocklist and has been specifically blocked by PhishDestroy, reinforcing the view that it has been identified as a malicious resource. The listed scam type is "Crypto Scam," and the threat classification supplied as "crypto drainer" aligns with known patterns where attackers lure victims into sending cryptocurrency to an address under the attacker’s control. Because the site is currently offline, direct interaction is not possible, but the infrastructure footprints remain active and may be reused for future campaigns.

Defenders should continue to block the IP 172.67.198.10 at network perimeters, enforce deny‑list rules for the domain, and monitor for any re‑registration of similar subdomains under the paintswap.pro hierarchy. Threat intelligence platforms should update their indicators of compromise (IOCs) to include the domain name, associated IP, and the observed trust score.