pryzmairdrop[.]live

Analysis of pryzmairdrop.live indicates that the domain was registered on 21 February 2026 and subsequently pointed to the Cloudflare‑owned address 172.67.147.245, ASN 13335, located in the United States. The TLS certificate, identified as WE1, was active at the time of observation. The site presented the page title “Pryzm Airdrop – Claim Your Tokens”, which aligns with the supplied classification of a crypto‑airdrop scam that impersonates Revolut. VirusTotal recorded a single positive detection out of 93 scanned engines, confirming that at least one security vendor flagged the domain as malicious.

The domain appears on two independent blocklists, PhishDestroy and ScamSniffer, and received a Gridinsoft trust score of 0 / 100, reinforcing the malicious assessment. The infrastructure utilizes a commercial CDN, which can obscure the underlying hosting environment but also indicates a low barrier to deployment for threat actors. Current network probes show the domain as taken offline, limiting immediate interaction but not precluding future re‑use of the same name or IP range. Defenders should add pryzmairdrop.live to URL filtering policies, block the associated IP address, and monitor for any resurgence of the domain or similar airdrop‑themed URLs targeting Revolut users.

Email gateways should be configured to flag messages that reference “airdrop” or “claim your tokens” in conjunction with Revolut branding. Continuous threat‑intel feeds should be consulted for new indicators of compromise linked to the AS13335 range, as other malicious campaigns frequently leverage Cloudflare for rapid deployment. Given the low trust score and blocklist presence, the domain should be treated as high‑confidence malicious, and any internal references to it must be quarantined.