airdrop-calculator[.]xyz

Analysis indicates that airdrop-calculator.xyz is an active crypto drainer scam domain, currently operational as of July 14, 2026. The domain was registered on May 16, 2026, through NAMECHEAP INC, and resolves to the IP address 66.33.60.66, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. The page title, 'Airdrop Calculator by RETRO STRATEGY,' suggests a fake airdrop scheme, a common tactic used to deceive users into connecting cryptocurrency wallets to malicious smart contracts that drain funds. The domain is associated with an 'Airdrop Scam' phishing kit, as identified in available threat intelligence. Infrastructure analysis reveals the use of nameservers from registrar-servers.com and Vercel, which may indicate an attempt to blend malicious activity with legitimate hosting patterns. The domain is flagged by one security vendor on VirusTotal and appears on a single security blocklist, specifically PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. The HTTP status code 200 confirms the site is currently accessible. While the domain's registration age is relatively recent (under two months), this is consistent with the lifecycle of phishing campaigns, which often rotate domains to evade detection. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. Defenders should treat this domain as malicious and prioritize blocking access at the network and endpoint levels. Additional monitoring of related infrastructure, such as associated IP addresses and nameservers, is recommended to identify potential pivot points for further compromise. The exact content of the site has not been analyzed, so specific wallet-draining mechanisms or targeted cryptocurrency networks remain unconfirmed.