airdrop-portals[.]live

The domain airdrop-portals.live is currently classified as a high‑risk crypto‑drainer. Operational status is active as of 12 July 2026, and it appears on one external security blocklist. The site presents a generic page title “Just a moment…”, returns HTTP 403, and is listed by PhishDestroy as blocked. Its SSL certificate is issued by Google Trust Services under the WE1 label, indicating a valid TLS chain despite malicious intent. Infrastructure analysis shows the domain was registered on 21 February 2026 through Web Commerce Communications Limited. Authoritative nameservers are alberto.ns.cloudflare.com and tiffany.ns.cloudflare.com, both belonging to Cloudflare. DNS resolution points to IP 188.114.97.3, which is announced by AS13335 Cloudflare, Inc. and geolocated to the United States. The Gridinsoft trust score for the domain is 0 / 100, reinforcing the malicious assessment. Detection engines provide additional confidence. VirusTotal reports that 8 of 95 scanned security vendors flag the domain as malicious. Cloudflare‑specific technologies observed include Cloudflare Browser Insights, Cloudflare itself, and HTTP/3 support, suggesting the attacker leveraged Cloudflare’s CDN for hosting. The combination of a zero trust score, blocklist presence, and multiple vendor detections points to an operational crypto‑draining campaign. Defenders should immediately block airdrop-portals.live at the DNS and proxy layers, and add the associated IP 188.114.97.3 to outbound deny lists. Continuous monitoring of newly created domains using the same registrar (Web Commerce Communications Limited) and similar Cloudflare name server patterns is advised. Incident response teams should also inspect any outbound traffic that may be attempting to contact this domain, as the intended payload is likely a cryptocurrency wallet credential collector.