defillama[.]airdropsalert[.]life

The domain defillama.airdropsalert.life was observed hosting a crypto airdrop scam and is currently taken offline. Google Safe Browsing categorizes the site as social engineering, and 15 of 95 VirusTotal scanners flagged it as malicious, indicating a consensus among security vendors that the domain is associated with fraudulent activity. The site resolves to IP address 199.59.243.228, which is hosted in the United States under ASN 16509, an Amazon.com, Inc. network. Registration details show the domain was provisioned through the BODIS-A registrar, also linked to ASN 16509, confirming the hosting infrastructure is Amazon‑owned.

No TLS certificate was presented, meaning the site operated without HTTPS, a common trait for low‑effort phishing kits. The page title returned by the server is "airdropsalert.life," matching the observed branding of the campaign. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, reinforcing its classification as a high‑risk crypto drainer.

While the site is presently offline, defenders should continue to enforce blocks on the domain and its associated IP address, monitor for any re‑registration or resurrection of the host, and incorporate the observed indicators into intrusion detection and web filtering policies. User education should emphasize that unsolicited airdrop notifications are a known vector for crypto theft, and any requests for wallet credentials or private keys should be treated as malicious. Ongoing vigilance is required to detect similar infrastructure that may reuse the same hosting provider or phishing kit in future campaigns.