airdrop-intuit[.]xyz

PhishDestroy identifies airdroop-intuit.xyz as an active crypto drainer impersonating Intuit’s official services. The domain is currently operational and leverages deceptive branding to trick users into connecting cryptocurrency wallets under the false pretense of an airdrop or reward program. This tactic is designed to exploit brand trust and facilitate unauthorized fund transfers. This domain was flagged by 12 of 95 VirusTotal security vendors, indicating it has not yet been widely recognized as malicious despite its suspicious behavior. It was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 172.67.190.127. The domain was created on April 28, 2026, and is currently not listed on any major blocklists. Trust scores from domain reputation services remain uncalculated or neutral, suggesting limited visibility in threat intelligence feeds. While under investigation, the site remains active and poses a high risk to users who engage with its fraudulent airdrop claims. PhishDestroy recommends blocking access to airdroop-intuit.xyz at the network and DNS levels. Users who have already interacted with this domain should immediately disconnect their wallets, revoke any suspicious token approvals, and monitor accounts for unauthorized transactions. Exercise caution with unsolicited airdrop offers claiming affiliation with Intuit or other financial platforms.