op[.]airdropsalert[.]live

Analysis of op.airdropsalert.live indicates this domain is associated with a fake crypto airdrop scam, classified as a crypto drainer threat. The domain was registered on October 20, 2025, through Dynadot LLC and is currently offline as of July 23, 2026. Infrastructure analysis reveals it resolved to IP 199.59.243.228, hosted on Amazon.com, Inc. (AS16509) in the United States. The domain uses nameservers ns1.dyna-ns.net and ns2.dyna-ns.net, consistent with registrar-provided DNS infrastructure. Security vendors have flagged this domain, with 14 of 93 engines on VirusTotal detecting malicious activity.

It appears on at least one security blocklist (PhishDestroy) and is identified as part of an Airdrop Scam phishing kit. The HTTP status returned a 200 response prior to takedown, suggesting the site was operational before being disabled. No SSL certificate was present, which is atypical for legitimate financial or crypto-related services. The page title, airdropsalert.live, aligns with the scam type, though the exact content and user interaction flow remain unanalyzed due to the domain's offline status. Defenders should treat this domain as high-risk for crypto-related fraud.

Indicators such as the lack of SSL, hosting on a major cloud provider, and detection by multiple security vendors support this classification. While the domain is currently offline, historical resolution data and detection results should be incorporated into threat intelligence feeds for retrospective analysis. If the domain reactivates, monitoring for changes in IP, SSL status, or hosting provider is recommended. No brand impersonation is confirmed beyond the generic airdrop scam classification, and further forensic analysis would be required to determine specific wallet-draining techniques or associated threat actor infrastructure.