grandtheftairdrop[.]click

Analysis of grandtheftairdrop.click indicates a confirmed fake crypto airdrop campaign designed to deploy a cryptocurrency drainer. The domain was registered on June 8, 2026, through Global Domain Group LLC and resolves to the IP address 5.255.119.182, hosted in the Netherlands under TIG infrastructure. As of July 23, 2026, the domain is offline, though prior scans revealed active malicious infrastructure. The page title, FASTPANEL, suggests the use of a common hosting control panel, potentially indicative of low-cost or automated hosting setups frequently exploited for phishing operations. Security vendor detections are substantial but not unanimous: 15 of 91 engines on VirusTotal flagged the domain as malicious at the time of scanning.

The domain appears on three security blocklists and is blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a high-risk threat. AlienVault OTX records the domain in four threat intelligence pulses, further corroborating its association with active malicious campaigns. The SSL certificate, issued under FASTPANEL with a 'parking' designation, aligns with patterns observed in ephemeral phishing domains that are rapidly deployed and discarded. Defenders should treat this domain as a confirmed crypto drainer threat.

While currently offline, the infrastructure may resurface under new domains or IPs. Historical resolution to 5.255.119.182 should be monitored for further malicious activity, and any associated SSL certificates or registrar details should be cross-referenced in threat intelligence platforms. Given the domain's presence in multiple blocklists and its association with known crypto-draining tactics, network-level blocking and alerting for related indicators are recommended. The exact content of the phishing page remains unanalyzed, but the available evidence supports its classification as a high-risk scam targeting cryptocurrency users.