airdrop[.]palio[.]digital

The domain airdrop.palio.digital was registered on 21 February 2026 and is presently hosted behind Cloudflare’s network (ASN 13335) with the address 172.67.160.197 located in the United States. Automated scanning on VirusTotal recorded detections from two of ninety-three security vendors, indicating that at least a minority of scanners identified malicious behavior. The site is classified as a crypto‑drainer scam, consistent with the broader “Crypto Scam” label in the intelligence feed. Both PhishDestroy and ScamSniffer have added the domain to their blocklists, and it appears on two additional security blocklists, reinforcing the assessment that it is being actively blocked by threat‑intel providers.

The TLS certificate presented for the site is identified as “WE1”, suggesting a standard Cloudflare‑issued certificate without additional validation. The domain’s current HTTP status is offline, meaning no live response was observed at the time of analysis. No public page title, Safe Browsing verdict, or Open Threat Exchange (OTX) entries were supplied, so the content and exact phishing tactics remain unknown. Likewise, the absence of detailed page‑level indicators prevents confirmation of the specific payload or wallet addresses used in the drainer operation.

Defenders should treat the domain as high‑risk given its elevated risk rating, the presence on multiple blocklists, and its association with a crypto‑drainer campaign. Recommended mitigations include adding the domain and its resolved IP address to network‑level deny lists, updating DNS filtering rules, and monitoring for any future re‑hosting attempts that might reuse the same IP range. Continuous re‑scanning of the domain, especially if it returns online, is advised to capture any changes in vendor detections or new threat‑intel signatures.