airdrop-synd[.]com

The domain airdrop-synd.com was registered on 21 February 2026 through PublicDomainRegistry.com (PDR Ltd.) and is currently resolved to the IPv6 address 2a06:98c1:3121::3, which belongs to Cloudflare’s network (AS13335). Its authoritative nameservers are hadlee.ns.cloudflare.com and will.ns.cloudflare.com, indicating that the site is fronted by Cloudflare’s edge service. The TLS certificate presented is issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3 and the site advertises Cloudflare Browser Insights and HTTP/3 support. An HTTP request returns a 403 status and the only observed page title is “Just a moment…”, suggesting a possible challenge page or content gating. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and two of ninety‑three VirusTotal scanners have flagged the domain, reinforcing the malicious assessment. The threat type is identified as a cryptocurrency drainer, but no additional payload or phishing page details have been captured, so the exact method of asset exfiltration remains unknown. Defenders should immediately add airdrop-synd.com to DNS‑based and proxy blocklists, monitor outbound connections to its Cloudflare IP, and correlate any attempted cryptocurrency transactions with this indicator. Continuous re‑scanning and threat‑intel sharing are recommended to detect any evolution of the infrastructure or new malicious payloads.