connectairdroplayer[.]com

This domain operates as a confirmed crypto wallet drainer phishing site impersonating Bitget, a major cryptocurrency exchange. The site presents a fraudulent "Connect-Air Droplayer" interface designed to trick users into connecting their crypto wallets, enabling attackers to siphon funds through malicious smart contract interactions. The threat specifically targets users participating in fake airdrop campaigns, a common tactic to lure victims into exposing wallet credentials and authorizing unauthorized transactions. Analysis of the domain reveals multiple high-confidence indicators of malicious activity. The domain was registered on November 25, 2025, through Web4Africa Inc., and currently resolves to IP address 102.130.123.35, hosted by Host Africa (Pty) Ltd in South Africa. VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious, while it appears on four independent security blocklists. The site lacks an SSL certificate, increasing the risk of credential interception during transmission. Additional red flags include its immediate takedown status and prior blocking by crypto-specific security tools like Polkadot and Enkrypt. Users who visited connectairdroplayer.com or interacted with its content should assume potential wallet compromise. Immediate actions include revoking all recent wallet authorizations via blockchain explorers, transferring remaining assets to a new wallet address, and scanning connected devices for malware. Monitor transaction histories for unauthorized activity and report the incident to the impersonated platform (Bitget) for further investigation. Given the domain's high-risk classification and confirmed crypto-draining functionality, affected users should treat this as a critical security breach requiring urgent mitigation.