safelloairdrop[.]com

This investigation documents the infrastructure associated with safelloairdrop.com, which was identified as a crypto‑drainer campaign leveraging a fake airdrop lure. The domain was registered on 21 February 2026 through Register.com – Network Solutions, LLC and is served by the authoritative name servers dns1.register.com and dns2.register.com. DNS resolution points to the IPv4 address 86.106.85.197, an IP block owned by AS9009 M247 Europe SRL and geolocated to the United Kingdom. No TLS certificate was observed for the site, indicating that connections were unencrypted. The landing page returns the title “Crypto Airdrop Landing”, matching the known “Airdrop Scam” phishing kit.

The site was subsequently taken offline, and its current HTTP status reflects an unavailable service. Detection data show that two of ninety‑five VirusTotal scanners flagged the domain, and four independent blocklists have already listed it. The domain is also explicitly blocked by the security aggregators PhishDestroy, Polkadot, Enkrypt, and Codeesura. MX records point to Google’s mail infrastructure (aspmx.l.google.com with priority 1 and alt1.as… truncated), suggesting that the operator used a public email service for outbound communications. Defenders should immediately block DNS resolution for safelloairdrop.com and the associated IP address 86.106.85.197 at perimeter firewalls and proxy layers.

Email gateways should be configured to reject or quarantine messages originating from the listed Google MX hosts when they reference the domain or the “Crypto Airdrop” theme. Monitoring of newly registered domains that employ the same registrar, name‑server pattern, or hosting ASN is advisable, as actors frequently recycle these assets. Because the site is offline, any active credential harvesting has likely ceased, but threat‑intel teams should continue to watch for re‑hosting attempts or replica campaigns that reuse the same page title or kit.