droplive[.]fun

PhishDestroy has flagged droplive.fun as an active crypto drainer scam, designed to steal cryptocurrency from unsuspecting users by impersonating legitimate NFT platforms. The domain leverages deceptive social-engineering tactics, such as fake airdrop offers or urgent transaction alerts, to trick victims into connecting their wallets and signing malicious transactions. Investigations reveal this is part of a broader campaign targeting users of high-value NFT collections, with infrastructure designed to drain funds instantly upon wallet connection. The domain resolves to IP address 104.21.6.28 and is registered through PDR Ltd. d/b/a PublicDomainRegistry.com, with a creation date of March 28, 2026. The site uses a valid Let's Encrypt SSL certificate to appear trustworthy, but it currently shows 0 detections out of 95 on VirusTotal as of the latest scan, indicating it has evaded automated detection systems. Public blocklists and threat intelligence platforms have not yet flagged this domain, placing users at high risk of exposure. The lack of detection highlights the sophisticated nature of the infrastructure, which is likely operated by an experienced threat actor using newly registered domains to avoid blacklisting. As of this report, droplive.fun remains active and unblocked, with an under-investigation risk rating. PhishDestroy continues to monitor and analyze the domain’s behavior, including any drainer kit payloads, wallet interactions, and redirection chains. Users are strongly advised to avoid visiting the site and to verify any suspicious links using PhishDestroy’s real-time scam detection tools. While the immediate risk is high due to low detection rates, ongoing takedown efforts and community reporting may lead to its remediation. However, the domain’s recent creation and clean reputation suggest it could remain active for an extended period, requiring continuous vigilance from both users and security teams.