sca[.]airsdropalert[.]click

The domain sca.airsdropalert.click is identified as a generic phishing site targeting users through fake cryptocurrency airdrop schemes. Analysis indicates the domain is designed to deceive victims into interacting with fraudulent airdrop promotions, likely leading to credential theft or wallet-draining attacks. As of the latest verification, the domain has been taken offline, though its infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered through Dynadot, LLC on November 05, 2025, and resolves to the IP address 188.114.96.3. It is flagged by 10 of 95 security vendors on VirusTotal, with one confirmed appearance on a security blocklist. The SSL certificate is issued by Google Trust Services (WE1), and the page title observed was 'Welcome to nginx!', a default placeholder often indicative of hastily deployed malicious infrastructure. The domain’s creation date suggests recent deployment, aligning with common phishing campaign timelines. Current status confirms the domain is offline, though residual risk persists due to its documented malicious activity. Organizations and users are advised to block the domain at the DNS level and monitor for related indicators, including the IP address 188.114.96.3 and associated SSL certificate thumbprints. Security teams should correlate this domain with other known phishing infrastructure, particularly those impersonating cryptocurrency services. End-users should verify airdrop legitimacy through official project channels and avoid interacting with unsolicited links or promotions.