airdrop[.]paintnswap[.]io

On 24 July 2026, the domain airdrop.paintnswap.io was observed hosting a fraudulent cryptocurrency airdrop campaign. The site presents the page title “Google”, indicating an attempt to masquerade as a Google‑related offering. VirusTotal analysis shows that 4 of 93 security engines flagged the domain, suggesting moderate detection. The domain resolves to IP 142.251.40.196, which belongs to the Google LLC Autonomous System AS15169 and is physically located in the United States. Hosting is fronted by Cloudflare, as evidenced by the presence of Cloudflare nameservers (matt.ns.cloudflare.com, nena.ns.cloudflare.com) and the detection of HTTP/3 support.

An SSL certificate issued by Google Trust Services (WE1) further reinforces the illusion of legitimacy. The HTTP response code returned was 523, indicating that the origin server was unavailable at the time of scanning. The domain was registered on 21 February 2026 through Immaterialism Limited, a registrar that does not provide additional protective metadata. The malicious infrastructure has been added to at least one security blocklist and is actively blocked by the PhishDestroy service, confirming that defensive feeds have recognized the threat. The campaign is classified as a “Fake Airdrop” and aligns with the broader “crypto drainer” threat category, although no on‑page content has been captured for deeper behavioural analysis.

Current status is offline, limiting immediate interaction but not precluding re‑use of the same infrastructure. Uncertainty remains regarding the full scope of victim targeting, the underlying payload delivery mechanisms, and whether the domain will be re‑registered for future operations. Defenders should continue to monitor the associated IP address and Cloudflare nameserver identifiers for re‑appearance, enforce outbound traffic restrictions to known crypto‑drain vectors, and incorporate the domain indicator into URL filtering and threat‑intel feeds.