airdropsite[.]live

This domain, airdropsite.live, is actively engaged in brand impersonation targeting cryptocurrency users through airdrop scam schemes. The infrastructure is designed to deceive victims into believing they are interacting with legitimate token distribution events, a tactic commonly used to harvest credentials or deploy malicious smart contracts. Analysis indicates the domain remains operational and poses an elevated risk to unsuspecting users. Infrastructure analysis reveals the domain was registered on March 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and currently resolves to the IP address 172.67.139.156. It is flagged by 5 of 95 security vendors on VirusTotal, blocked by at least three security blocklists, and employs Cloudflare services, including Browser Insights and HTTP/3, to obfuscate its operations. The page title, 'Just a moment...', is consistent with intermediary loading screens used to mask malicious redirects or payload delivery. The domain remains active, and users are advised to exercise caution when encountering any content associated with airdropsite.live. Network-level blocking of the IP 172.67.139.156 is recommended for organizations, while individuals should verify token distribution legitimacy through official project channels. Monitoring for additional domains registered under the same registrar or resolving to the same IP may help identify related malicious infrastructure.