airdropxos[.]live

This domain is flagged for elevated-risk brand impersonation targeting Facebook users through a fraudulent crypto airdrop scheme. Analysis indicates the site masquerades as a legitimate token distribution platform, exploiting trust in the Facebook brand to deceive victims into engaging with malicious smart contracts or credential harvesting mechanisms. The specific threat type involves social engineering tactics designed to trick users into connecting wallets or entering sensitive information under the guise of claiming non-existent tokens. Infrastructure analysis reveals the domain airdropxos.live was registered through Web Commerce Communications Limited and currently resolves to the IP address 172.67.177.189, a Cloudflare-hosted endpoint utilizing HTTP/3. The site appears on at least one security blocklist, with PhishDestroy actively blocking it. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The page title, 'XOS Airdrop - Claim Your Tokens,' directly aligns with common crypto scam patterns, further corroborating its fraudulent intent. The domain has since been taken offline, though historical DNS records and cached content may still pose residual risks. Mitigation steps for this brand impersonation threat include immediately revoking any wallet connections or credentials shared with the domain. Users should verify all crypto airdrop claims through official Facebook channels or the project’s authenticated website, avoiding links from unsolicited messages or social media posts. Organizations should update blocklists to include the domain and its associated IP, while security teams monitor for related infrastructure, such as newly registered lookalike domains or similar Cloudflare-hosted endpoints. If wallet interactions occurred, users should audit transaction histories for unauthorized transfers and consider migrating assets to a new wallet address. Browser-based crypto extensions should also be reviewed for potential compromise.