airdrop-foruai[.]live

airdrop-foruai.live is a newly registered domain, created on 11 March 2026 and listed under the registrar PDR Ltd. d/b/a PublicDomainRegistry.com. The zone is delegated to Cloudflare name servers karl.ns.cloudflare.com and bristol.ns.cloudflare.com, and resolves to the Cloudflare edge address 172.67.172.1, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Let’s Encrypt (CN=E8) and returns HTTP 403 for direct requests, while the page title displayed to browsers reads “Un momento…”.

The domain appears on three independent blocklists – PhishDestroy, MetaMask and SEAL – confirming its classification as a high‑risk crypto‑drainer campaign. Gridinsoft assigns a trust score of 0 out of 100, and AlienVault OTX references the domain in a single threat‑intelligence pulse. VirusTotal analysis shows that one of ninety‑five scanned security vendors flagged the domain, indicating early detection by at least one scanner.

Intelligence indicates that the site is used to lure cryptocurrency users into authorizing malicious transactions, a typical pattern for crypto‑drainer operations. The observed page title and the 403 response suggest a front‑end that may redirect or serve malicious JavaScript only after specific user interaction, but no payload has been captured in public scans. Consequently, the exact phishing vector, targeted wallet addresses, and the extent of compromised accounts remain unknown.

Defenders should block the host name and its resolved IP at network perimeter and DNS layers, and add the domain to internal blocklists to prevent credential or wallet exposure. Continuous monitoring of Cloudflare edge IP ranges for similar 403 responses and anomalous TLS certificates can help detect replicas. Incident response teams should treat any user‑initiated transaction approvals originating from this domain as compromised and advise affected users to revoke authorizations and rotate credentials.