blast[.]airdropsalert[.]live

Analysis confirms that blast.airdropsalert.live was registered on 20 October 2025 through Dynadot LLC and resolves to the Amazon‑owned address 199.59.243.228 (AS16509, United States). The domain is served by the authoritative nameservers ns1.dyna‑ns.net and ns2.dyna‑ns.net, and it presented an HTTP 200 response without an SSL certificate. The page title returned by the web server is “airdropsalert.live”, which matches the observed kit label “Airdrop Scam”. The site was identified as a fake‑airdrop campaign that impersonates the cryptocurrency project Blast.

Detection engines on VirusTotal recorded 13 positive detections out of 95 scanners, and the domain is listed on at least one public security blocklist. Google Safe Browsing classifies the URL as a social‑engineering threat, and the anti‑phishing service PhishDestroy has already blocked the address. The hosting provider, Amazon Web Services, is a common choice for abuse actors because of its scalability and rapid provisioning. Although the site has been taken offline, the infrastructure artifacts remain observable and can be used for attribution and future mitigation.

Uncertainty remains around the exact content shown to victims, the presence of any credential‑harvesting forms, or secondary payload delivery, because the page is no longer reachable for direct inspection. Defenders should add blast.airdropsalert.live to internal URL blocklists, monitor the associated IP 199.59.243.228 and its AWS AS16509 CIDR ranges for related activity, and enforce TLS‑only policies to prevent clear‑text connections to similar domains. Continued observation of the Dynadot nameservers for newly created sibling domains is also advised, as the attacker may reuse the same registrar for future campaigns.