airdrop-dawn[.]live

This domain is classified as an elevated-risk threat due to brand impersonation targeting MetaMask, a widely used cryptocurrency wallet. The fraudulent activity is designed to deceive users into believing they are participating in a legitimate token airdrop, a common tactic in cryptocurrency scams to harvest credentials or private keys. Analysis indicates the domain airdrop-dawn.live was registered through Web Commerce Communications Limited and resolves to the IPv6 address 2606:4700:3034::ac43:c957. The SSL certificate is issued by Google Trust Services (WE1), a detail often exploited to lend false legitimacy. VirusTotal reports detection by 1 of 95 security vendors, and the domain appears on at least one security blocklist. The page title, 'Dawn Airdrop - Claim Your Tokens,' directly mimics MetaMask’s branding to enhance credibility. The domain is currently offline, suggesting either takedown or voluntary suspension by the threat actor. To mitigate risks associated with this type of brand impersonation, users should verify airdrop announcements exclusively through official channels, such as the verified website or social media accounts of the targeted brand. Cryptocurrency wallet credentials should never be entered on third-party sites, even if they appear visually similar to legitimate platforms. Enabling multi-factor authentication and monitoring for unauthorized transactions can further reduce exposure. Organizations should update blocklists with the domain and associated indicators, including the IPv6 address and SSL certificate issuer, to prevent future access attempts.