airdrop-cex[.]live

PhishDestroy has identified airdrop-cex.live as a fraudulent domain engaged in brand impersonation, specifically targeting users with a fake airdrop scheme mimicking CEX. The site, which displayed the title 'CEX Airdrop - Claim Your Tokens', is designed to trick visitors into connecting their crypto wallets or sharing sensitive information, likely leading to asset theft. This threat is classified as a crypto drainer and falls under the brand_impersonation category, with the brand target being Airdrop Scam.

Technical analysis reveals several key indicators. On VirusTotal, 1 out of 95 security vendors flagged the domain as malicious, reflecting a low but notable detection rate. The domain was registered through Web Commerce Communications Limited and resolves to IP address 172.67.190.54. An SSL certificate was issued by Google Trust Services (WE1), which may lend a false sense of legitimacy. The domain appears on one security blocklist, indicating limited but existing recognition by threat intelligence platforms. No GSB (Google Safe Browsing) status was provided, but the domain's registration details and hosting infrastructure align with common phishing patterns.

Currently, airdrop-cex.live has been taken offline, reducing immediate risk to potential victims. However, the domain could be reactivated or similar domains may appear. Users who have visited the site or entered any information should consider their crypto wallets and accounts compromised and take immediate action, such as revoking permissions and moving assets. PhishDestroy advises all users to verify any airdrop or token claim offers through official channels and to never connect wallets to untrusted sites. Continued vigilance is recommended as the threat actors may deploy new domains under different registrars.