airdrop-inco[.]live

This domain is flagged for elevated risk due to targeted brand impersonation, specifically mimicking Revolut to deceive users into engaging with fraudulent crypto airdrop offers. The threat type is classified as brand impersonation, designed to exploit trust in financial services brands to facilitate unauthorized transactions or credential theft. Analysis indicates the domain airdrop-inco.live was registered through Web Commerce Communications Limited and resolves to the IP address 172.67.217.24, hosted on Cloudflare infrastructure (AS13335). VirusTotal reports 11 out of 95 security vendors detecting malicious activity associated with this domain. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to lend legitimacy to phishing sites. The domain appears on one security blocklist and was recently taken offline, though its infrastructure remains a potential vector for future threats. The page title, 'Inco Airdrop - Claim Your Tokens,' directly targets cryptocurrency users, a demographic frequently exploited in such schemes. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address (172.67.217.24) at the network level. Organizations should monitor for similar domains registered through Web Commerce Communications Limited or leveraging Cloudflare hosting, as these may indicate related phishing campaigns. Users should be educated to verify the authenticity of airdrop offers by cross-referencing with official brand communications, particularly those involving financial or crypto-related services. Additionally, security teams should prioritize reviewing logs for connections to the IP address and domain to identify potential compromise or unauthorized access attempts.