airdrop[.]sclabs[.]xyz

The domain airdrop.sclabs.xyz was registered on February 21, 2026 and is currently listed as offline. DNS resolution points to the IP address 104.21.67.229, which belongs to AS13335 operated by Cloudflare, Inc., and is geolocated in the United States. The site presents the generic page title "Just a moment..." and serves an SSL certificate identified as WE1. Reputation scoring from Gridinsoft assigns a trust score of zero out of one hundred, indicating a complete lack of confidence in the host.

The domain is flagged by PhishDestroy and appears on a single external security blocklist. VirusTotal analysis shows that five of ninety‑three scanning engines have raised detections against the domain, reinforcing the suspicion of malicious activity. The classification in the supplied intelligence is a crypto scam, specifically a crypto drainer, which typically attempts to exfiltrate cryptocurrency assets from unsuspecting victims. While the offline status prevents direct observation of payload delivery mechanisms, the combination of a newly created domain, zero trust score, Cloudflare fronting, and multiple vendor detections suggests that the infrastructure was deliberately provisioned for a short‑lived financial fraud campaign.

Defenders should continue to block the domain at perimeter controls, monitor for any residual connections to the associated IP address, and update threat intelligence feeds to include the domain’s indicators of compromise. Additional investigation is warranted to determine whether the IP address hosts other malicious domains and to capture any residual command‑and‑control traffic that may have persisted before the takedown. Until further evidence is collected, the domain should be treated as a high‑confidence crypto‑drainer threat.