openfix[.]live

The domain openfix.live was registered on 23 December 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 172.67.182.82 (AS13335, United States). DNS resolution is served by dale.ns.cloudflare.com and fiona.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns a 522 “Connection timed out” page title indicating that the origin server failed to respond. Analysis by multiple security services identifies the site as employing the Airdrop Scam phishing kit.

VirusTotal reports three of ninety‑three scanners flagging the domain as malicious. Independent rating systems assign a Gridinsoft trust score of 0 / 100, confirming the malicious posture. The domain is listed on four public blocklists and is actively blocked by the PhishDestroy, Polkadot, Enkrypt, and Codeesura sinks. Current operational status is offline, suggesting that the infrastructure has been taken down or is temporarily unavailable.

Because the domain is newly created (less than nine months old) and lacks encryption, it is likely being used for short‑lived credential‑harvesting campaigns targeting users lured by airdrop promises. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑use of the underlying IP address, and consider adding the domain to internal threat‑intel feeds. Additional investigation is limited to the observed indicators; no content was captured beyond the timeout title, so the exact payload and target audience remain uncertain.