immuai[.]live

This domain, immuai.live, is actively engaged in brand impersonation specifically targeting cryptocurrency users through an airdrop scam. The page presents itself under the title $IAI Airdrop, falsely associating with legitimate crypto projects to deceive victims into disclosing sensitive information or transferring assets. Analysis confirms the domain remains operational and continues to pose a high-risk threat to unsuspecting users seeking airdrop opportunities. Infrastructure analysis reveals immuai.live was registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to the IP address 104.21.72.131, hosted behind Cloudflare, Inc. infrastructure in Canada. Security vendors on VirusTotal have flagged this domain as malicious, with 3 out of 95 engines detecting it. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice among threat actors to lend superficial legitimacy. The domain appears on three distinct security blocklists, further corroborating its malicious intent. Current assessment indicates immuai.live remains active and continues to propagate the airdrop scam. Users are strongly advised to avoid interacting with this domain or any associated links. Network administrators should implement blocking measures at the DNS or firewall level to prevent access. Individuals who may have engaged with this domain should immediately revoke any connected wallet permissions, monitor accounts for unauthorized transactions, and consider resetting credentials for associated platforms. Ongoing vigilance is recommended, as similar domains may emerge under different names but with identical fraudulent objectives.