airdrop-pooleth[.]com

The domain airdrop-pooleth.com was registered on February 21, 2026 and is currently taken offline. Passive DNS shows the name resolving to the IPv4 address 104.247.81.53, which belongs to an autonomous system (AS206834) operated by Team Internet AG in Canada. The same IP appears on a single public blocklist and has been flagged by the PhishDestroy blocklist for malicious activity. A single security vendor out of ninety‑three submitted to VirusTotal reported a detection, indicating at least one scanner identified suspicious behavior associated with the domain.

The site presented a page title of "torrentz.eu," a mismatch that suggests possible domain‑fronting or reuse of unrelated branding to obscure intent. SSL inspection reports the certificate label "R11," a non‑standard identifier that provides no clear trust indication. Gridinsoft assigned a trust score of 0 out of 100, reflecting a complete lack of confidence in the domain’s legitimacy. The intelligence categorizes the activity as a "Crypto Scam" and specifically labels the threat as a crypto drainer, implying attempts to illicitly siphon cryptocurrency assets from victims.

While the offline status limits real‑time interaction, the combination of a low trust score, mismatched page title, single‑vendor detection, and inclusion on a blocklist suggests a high likelihood of malicious intent. Uncertainty remains regarding the exact payload or delivery mechanism, as no payload hashes, command‑and‑control indicators, or detailed phishing content have been disclosed. Defenders should continue to block the resolved IP range, monitor for any resurgence of the domain, and incorporate the domain hash into threat‑intel feeds. Network traffic to 104.247.81.53 should be logged and inspected for anomalous crypto‑related requests, and endpoints should be scanned for any remnants of crypto‑draining malware that may have been delivered before the takedown.