ethxy[.]airdropsalert[.]life

Analysis of ethxy.airdropsalert.life indicates that the domain is actively associated with a high‑risk crypto drainer operation. The domain was registered on October 17, 2025 through Dynadot LLC and resolves to the Amazon Web Services IP address 199.59.243.228, which is listed under ASN AS16509 in the United States. No TLS certificate is presented, meaning the site would have been served over plain HTTP if it were reachable. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy has confirmed it as a blocked resource.

The site is catalogued as using the "Airdrop Scam" phishing kit, a known template for crypto‑related fraud. VirusTotal reports that 14 of 95 security vendors have flagged the domain, reinforcing the malicious classification. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist, demonstrating that at least one external feed has labeled it as malicious. The page title returned by the server, "airdropsalert.life," matches the domain suffix and provides no indication of legitimate content.

Current online status is offline, which may be due to takedown actions or temporary hosting disruption. Uncertainties remain regarding the exact payload or transaction mechanisms used, as no SSL or HTTP response data is available for deeper inspection. Defenders should continue to block the domain at network perimeter devices, update DNS blacklists with the IP 199.59.243.228, and monitor for any resurgence of the domain or related subdomains. Continuous monitoring of threat‑intel feeds for additional indicators of compromise is recommended, as the infrastructure may be repurposed for future crypto‑draining campaigns.