simemes[.]airdropsalert[.]live

Analysis on 23 July 2026 indicates that the domain simemes.airdropsalert.live is currently offline but was previously reachable and returned HTTP 200. The domain resolves to 199.59.243.228, an address owned by Amazon.com, Inc. (AS16509) located in the United States. Registration details show the domain was created on 20 October 2025 through Dynadot LLC, using the authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net. No SSL certificate was observed, meaning traffic was unencrypted. The page title returned by the server is “airdropsalert.live”, matching the known brand used in fake airdrop campaigns.

VirusTotal scans recorded 13 detections out of 95 vendors, confirming malicious classification. The domain appears on a single security blocklist and is specifically listed by PhishDestroy as a phishing source. The associated phishing kit is identified as “Airdrop Scam”, reinforcing the fake airdrop narrative. These indicators collectively support the classification of the domain as a crypto drainer that attempts to lure victims with fraudulent airdrop promises. Uncertainty remains regarding the current activity of the site, as it is now taken offline; no further content analysis or payload capture is available.

Defenders should block the IP address 199.59.243.228 and add the domain to domain‑based deny lists. Monitoring of the hosting ASN (AS16509) for new subdomains exhibiting similar characteristics is recommended, as well as continued surveillance of Dynadot‑registered domains that share the same nameserver set. Organizations should also educate users about unsolicited airdrop notifications and discourage interaction with unknown URLs, especially those lacking TLS protection. Incident response teams can reference the VirusTotal detection count and the PhishDestroy blocklist entry when correlating logs, and should consider the lack of an SSL certificate as an additional risk factor when assessing traffic to this host.