intensiv-po-airdrop[.]su

The domain intensiv-po-airdrop.su was a crypto drainer phishing site designed to steal cryptocurrency from victims by draining wallet funds. No legitimate brand or drainer kit was identified as being impersonated. As of the latest verification, intensiv-po-airdrop.su has been taken offline, though it previously posed an elevated risk to users who interacted with it.

Technical indicators show that intensiv-po-airdrop.su was flagged by 3 of 95 VirusTotal security vendors, including CRDF, Gridinsoft, and SOCRadar. The domain was created on February 21, 2026, and resolved to the IP address 176.57.67.170, hosted by DDoS-Guard (AS57724, RU). It appeared on 1 security blocklist, specifically PhishDestroy, and used an SSL certificate issued by Let's Encrypt (R13). The observed page title was 'Domain has been assigned,' and the HTTP status returned a 404 error. Nameservers for the domain were ns1.tildadns.com and ns2.tildadns.com.

Users who interacted with intensiv-po-airdrop.su should immediately revoke any token approvals granted to the site using a tool like Etherscan's token approval checker or Revoke.cash. Funds should be moved to a new wallet to prevent further unauthorized transactions. If credentials or wallet details were entered, enable two-factor authentication on all accounts and monitor for fraudulent activity. Report the domain to platforms like Google Safe Browsing, PhishTank, or local cybercrime units to aid in takedown efforts.