haedal[.]airdropsalert[.]live

This domain haedal.airdropsalert.live is currently flagged as a high‑risk crypto drainer. The site resolves to the Amazon‑hosted IP address 199.59.243.228, which is registered to AS16509 (Amazon.com, Inc.) in the United States. The domain was registered on 20 October 2025 through Dynadot LLC and uses the default Dynadot nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net. No TLS certificate was observed, and an HTTP request returned a 200 status code with the page title “airdropsalert.live”. Analysis of the content indicates the use of an “Airdrop Scam” phishing kit and the classification “Fake Airdrop”, consistent with a crypto‑draining campaign that promises bogus token airdrops to lure victims into handing over private keys or sending funds.

Detection telemetry shows that 14 of 93 VirusTotal scanners flagged the domain, and Google Safe Browsing lists it under social‑engineering threats. The blocklist service PhishDestroy has taken the domain offline, and it appears on one additional security blocklist. These signals collectively confirm malicious intent, but the exact payload delivery method and victim interaction flow have not been captured because the site is no longer reachable. Defenders should block traffic to 199.59.243.228 and add haedal.airdropsalert.live to URL filtering policies.

Because the infrastructure resides on a shared Amazon cloud provider, further monitoring of related sub‑domains or adjacent IP ranges may be warranted. Incident responders should also advise users that any unsolicited airdrop offers are likely fraudulent and that private keys should never be entered on unknown sites. For threat‑intel teams, the association with the “Airdrop Scam” kit provides a linkage to other campaigns that employ the same template, enabling correlation across observed phishing artifacts. Continuous re‑scanning of the domain is recommended should it reappear, as the current evidence is limited to the snapshot taken before takedown.