airdroploop[.]live

PhishDestroy identifies airdroploop.live as an active brand impersonation domain targeting users with deceptive Airdrop Scams. This domain was flagged under investigation with a confirmed risk level indicative of ongoing malicious activity. The primary threat posed is financial theft through fraudulent cryptocurrency airdrop claims, where victims are lured into connecting wallets or submitting personal information under false pretenses. This domain was registered on May 05, 2025, through Web Commerce Communications Limited dba WebNic.cc, resolving to the IP address 104.21.54.110. Notably, the SSL certificate is issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. Currently, VirusTotal reports 0 detections out of 95 scanners, suggesting it has evaded broad detection mechanisms. No known blocklists or threat intelligence platforms have flagged this domain as of this advisory. The domain's recent creation date and lack of detections indicate it is likely in an early operational phase, actively targeting potential victims. Mitigation for this threat requires immediate action to prevent further exploitation. Users should block the domain airdroploop.live at the network and DNS levels to prevent access. Organizations are advised to update firewall rules and proxy blocks to include this domain and its resolving IP (104.21.54.110). Security teams should monitor for any associated wallet addresses or additional infrastructure linked to this domain, as threat actors often pivot quickly. Consumer guidance includes verifying the authenticity of any airdrop campaigns through official project channels and avoiding unsolicited links promising cryptocurrency rewards. Additionally, enabling wallet address whitelisting and transaction alerts can provide an extra layer of defense against fraudulent airdrop scams.