trmpairdrop[.]tech

Analysis of trmpairdrop.tech indicates that the domain was registered on November 04, 2025 through the registrar REGRU-RU, which is operated by REG.RU. The domain resolves to IP address 37.140.192.114, an address allocated to AS197695, also owned by REG.RU in Russia. No TLS certificate is presented for the site, meaning communications are unencrypted. The authoritative nameservers are ns1.hosting.reg.ru and ns2.hosting.reg.ru, both belonging to the same hosting provider.

The page title returned by the server, "TRUMP MEME - Crypto Airdrop", together with the identified phishing kit labeled "Airdrop Scam", aligns the activity with a crypto‑draining scheme that promises an airdrop in exchange for user funds. The domain appears on five independent security blocklists and is explicitly blocked by PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, reinforcing the malicious classification. VirusTotal analysis shows that one out of ninety‑five scanners flagged the domain, providing additional vendor‑level confirmation of suspicious behavior.

Current operational status is offline, and the site is no longer reachable, which limits immediate observation of content but does not remove the underlying infrastructure threat. Defenders should continue to block the domain at network perimeters, monitor the associated IP range for any re‑use, and consider adding the domain to internal threat intelligence feeds. Ongoing vigilance is advised, especially because the lack of SSL and the use of a known airdrop scam kit suggest that the infrastructure could be repurposed for future crypto‑drainer campaigns.