Verificação de phishing e segurança de commoncheck.live

The domain commoncheck.live was observed hosting a fake airdrop phishing page titled “Common | Airdrop”. The site was registered through Name.com, Inc. on February 21, 2026 and resolved to the IP address 185.107.74.113, which belongs to AS200430 owned by WEBO LLC and is geolocated to Sweden. Four name servers—ns2dqr.name.com, ns4cfn.name.com, ns3gxy.name.com, and ns1crv.name.com—were configured for the domain. No TLS certificate was presented when the site was accessed, indicating that communications were unencrypted.

The page was flagged by the PhishDestroy blocklist and appears on a single security blocklist at the time of analysis. VirusTotal reported that the domain was scanned by ninety‑three antivirus and URL‑reputation engines; none of the engines raised a detection, although the absence of a flag does not constitute validation of safety. The site is currently offline, and no HTTP response codes or content were captured after takedown. The evidence suggests an opportunistic phishing campaign that leveraged the popularity of airdrop incentives to lure victims, but the limited infrastructure footprint—single IP, single registrar, and a short lifespan—makes attribution difficult.

Defenders should continue to monitor the IP address 185.107.74.113 and the associated autonomous system for any re‑use, enforce outbound filtering for URLs containing “commoncheck.live”, and add the domain to internal blocklists. Since the page title references an airdrop, organizations handling cryptocurrency assets should alert users to the risk of unsolicited airdrop offers, especially those that request credentials or personal information. Ongoing threat‑intelligence feeds should be consulted for any resurgence of the domain or related infrastructure, and any future observations should be correlated with the registrar Name.com, Inc. and the observed name‑server pattern for rapid detection.