twtairdrop[.]org

Analysis of the domain twtairdrop.org indicates it was actively involved in a crypto drainer scam, as classified by security vendors. The domain, created on February 21, 2026, resolved to IP address 92.113.18.29, hosted on AS47583 (Hostinger International Limited) in Germany. The page title 'Bot Verification' suggests an attempt to deceive users into completing fraudulent verification steps, a common tactic in crypto-related scams. As of July 23, 2026, the domain is offline, though its infrastructure remains a potential threat.

Infrastructure evidence includes an SSL certificate labeled WR1, which may indicate a low-cost or automated issuance pattern often seen in phishing campaigns. Only one of 93 security vendors on VirusTotal flagged the domain, though this limited detection does not imply safety—many malicious domains evade initial scans. The domain appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigned a trust score of 0/100, reinforcing its high-risk classification.

Defenders should treat this domain as compromised and avoid any interaction. While the site is currently offline, the registration details, hosting provider, and SSL certificate warrant continued monitoring. If the domain reactivates, it is likely to resume its crypto drainer operations. Organizations should update blocklists to include twtairdrop.org and its associated IP, and monitor for related infrastructure reuse under new domains or IPs.