airdrop-velora[.]live

Analysis of airdrop-velora.live shows that the domain was created on 21 February 2026 and is registered through Web Commerce Communications Limited. The authoritative nameservers marjory.ns.cloudflare.com and felipe.ns.cloudflare.com resolve the domain to the Cloudflare edge address 104.21.48.1, located in the United States under AS13335. The TLS certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid‑looking HTTPS endpoint despite malicious intent. The site is classified as a brand‑impersonation campaign targeting the “Airdrop Scam” brand and employs a cryptocurrency‑drain narrative. VirusTotal reports five out of ninety‑five scanners flagging the domain as malicious, and the domain appears on a single security blocklist. PhishDestroy has already blocked the host, and the overall risk rating is high with an active status. Technical fingerprints include Cloudflare Browser Insights, the Cloudflare service itself, and HTTP/3 support. HTTP requests return a 403 status code and the page title is reported as “Just a moment…”, a common placeholder for challenge pages. Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the malicious assessment. Current intelligence does not reveal the exact payload or phishing kit employed, and no visual content has been captured. The lack of detailed page content means that the precise method of user deception (e.g., fake wallet prompts or credential harvest) remains unknown. Additional sandbox or manual browsing would be required to confirm the user‑facing behavior. Defenders should block or sinkhole airdrop-velora.live at the DNS level and monitor outbound connections to the Cloudflare IP 104.21.48.1. Email gateways should flag any messages referencing the domain or the “Airdrop Scam” brand. Continuous re‑scanning with multiple AV engines is advised to capture any evolving indicators, and incident response teams should treat any interaction with the site as compromised.