kylixfinance[.]airdropsalert[.]life

On 23 July 2026, investigators observed the domain kylixfinance.airdropsalert.life. The domain was registered on 17 October 2025 through Dynadot LLC and currently resolves to the IPv4 address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) in the United States. No TLS certificate is presented; the site operates without SSL, exposing any traffic to interception. Analysis by VirusTotal shows that 15 of 95 scanned security vendors flagged the domain as malicious, indicating a moderate consensus among scanners. The site appears on a single public security blocklist and is explicitly blocked by the PhishDestroy service.

Google Safe Browsing classifies the URL as a social‑engineering threat, reinforcing the malicious intent. The page title returned by the server is “airdropsalert.life”, matching the secondary domain used in the URL path and suggesting a branding attempt to lure cryptocurrency users. The infrastructure is identified as an “Airdrop Scam” phishing kit, a known template frequently used to harvest private keys or redirect victims to crypto‑draining services. The overall scam classification is a crypto scam, specifically a crypto drainer, which typically attempts to trick victims into sending cryptocurrency to attacker‑controlled wallets. The site’s current HTTP status is offline, indicating that the operators have taken the infrastructure down or are rotating hosts.

Because the domain is newly created (less than a year old) and already exhibits multiple detection signals, defenders should proactively block the domain at perimeter firewalls, DNS resolvers, and endpoint web filters. Monitoring of the associated IP address 199.59.243.228 for future re‑use is advised, as Amazon‑hosted infrastructure can be quickly repurposed. Analysts should also watch for similar “airdropsalert.life” patterns in other newly registered domains, and consider adding the domain to threat‑intel feeds used by SOCs.