airdrop[.]aiverse[.]vip

This domain is flagged as a brand impersonation threat targeting Sui, a cryptocurrency platform. Analysis indicates the domain was designed to deceive users into believing it is an official airdrop portal, leveraging social engineering tactics to extract sensitive credentials or digital assets. The risk level remains under investigation due to its recent takedown, but the infrastructure and intent align with known fraudulent schemes in the cryptocurrency space. Infrastructure analysis reveals the domain was registered on June 19, 2025, through NameCheap, Inc. and resolves to the IP address 172.67.190.147, a Cloudflare-protected endpoint. Technologies detected include Vue.js for frontend development and HTTP/3 for optimized connectivity, while the SSL certificate is issued by Let’s Encrypt. The domain appears on one security blocklist (PhishDestroy) and holds a Gridinsoft trust score of 0/100, indicating high suspicion. VirusTotal reports 0/95 detections, suggesting it has not yet been widely flagged by security vendors, though this may reflect its recent emergence or evasion techniques. Mitigation steps for this threat type include immediate domain blacklisting in enterprise security gateways and endpoint protection systems. Cryptocurrency platforms should issue public advisories to users, emphasizing that official airdrops are never hosted on domains resembling third-party brands (e.g., aiverse.vip). Network administrators should monitor for connections to 172.67.190.147 and inspect traffic for Vue.js-based interactions, which may indicate compromise attempts. Users are advised to verify airdrop legitimacy through official Sui communication channels and avoid interacting with domains created within the last 90 days that lack verifiable ownership records.