multiplepassairdrop[.]dappsyn[.]xyz

multiplepassairdrop.dappsyn.xyz was registered on 21 February 2026 and later observed serving a page titled “Multiple”. The site is explicitly claimed to impersonate Discord and is categorized as a social‑media phishing campaign. Automated analysis by VirusTotal recorded detections from 11 of 95 scanned AV engines, indicating a non‑trivial malicious profile. The domain is listed on a single public phishing blocklist and is actively blocked by the PhishDestroy service.

Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the host. SSL information shows a certificate labelled R13, which is typical of low‑cost or auto‑issued certificates used by threat actors. The site’s current HTTP response is offline, suggesting the operators have taken it down, but the artefacts remain useful for attribution and defensive rule creation.

Defenders should add the fully qualified domain name to DNS‑based blocklists, update URL filtering appliances, and monitor for future registrations that reuse the “multiplepassairdrop” pattern or similar Discord‑related keywords. Because the page content has not been publicly archived, analysts should treat the “Multiple” title as the only visible indicator of the landing page. Continuous threat‑intel feeds should be consulted for any re‑appearance of the domain or related infrastructure, and any observed traffic to the domain should be logged for correlation with credential‑theft attempts targeting Discord users.