event-oresupply[.]live

This domain is flagged as a high-risk crypto airdrop scam, specifically designed to impersonate legitimate cryptocurrency distribution events. The site presents itself as an $ORE airdrop, a tactic commonly employed to deceive users into connecting wallets or divulging private keys, leading to unauthorized asset transfers or account compromise. The threat type, classified as brand impersonation with crypto-draining capabilities, poses significant financial risk to unsuspecting victims. Infrastructure analysis reveals the domain event-oresupply.live was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The domain resolves to the IP address 104.21.29.153, which is hosted behind Cloudflare, a service often leveraged to obfuscate server origins and evade detection. The SSL certificate is issued by Google Trust Services, providing a false sense of security. The domain was created on May 31, 2026, an anomalous future date suggesting potential registration system manipulation or typo-squatting. Detection metrics indicate 12 out of 95 security vendors on VirusTotal have flagged this domain as malicious. Additionally, the domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer, further corroborating its malicious intent. Technologies detected on the site include HSTS, Cloudflare Browser Insights, and HTTP/3, which are consistent with modern phishing infrastructure designed to mimic legitimate platforms. To mitigate risks associated with this crypto airdrop scam, users are advised to refrain from interacting with the domain or any associated links. Wallet connections should never be authorized on unverified platforms, particularly those promoting unsolicited airdrops. Verification of cryptocurrency distribution events should be conducted exclusively through official project channels, such as verified social media accounts or developer documentation. Network-level protections, such as DNS filtering or endpoint detection rules, can be implemented to block access to the domain and its resolving IP. Security teams are encouraged to monitor for indicators of compromise, including the domain, IP address, and registrar details, to prevent further exploitation within their environments.