dbr[.]airdrpsalert[.]life

Analysis of dbr.airdrpsalert.life as of July 24, 2026 indicates the domain is currently offline but retains evidence of malicious activity. The domain resolves to the IP address 188.114.97.3, which belongs to AS13335 operated by Cloudflare, Inc. and is geolocated in the United States. Registration was performed through Cloudflare, Inc., a common front for fast‑flux and abuse‑hosting services. No TLS certificate is presented, and an HTTP request returns a 502 Bad Gateway response with the page title “airdrpsalert.life | 502: Bad gateway”, confirming that the web server is not delivering content at the time of testing. Threat intelligence classifies the site as a credential‑phishing operation employing an “Airdrop Scam” kit.

The kit typically harvests login credentials by masquerading as an airdrop reward service, although the exact page content was not captured. Ten of ninety‑five VirusTotal scanners flagged the domain, providing additional corroboration of malicious intent. The domain appears on a single external blocklist and has been explicitly blocked by the PhishDestroy service, demonstrating that at least one anti‑phishing feed recognizes it as hostile. Gridinsoft assigns a trust score of 0 out of 100, indicating maximal suspicion. Because the site is offline, active probing is limited, and the current status may change if the operators reactivate the host.

Defenders should continue to block the domain at perimeter firewalls and proxy devices, enforce DNS sink‑hole or response policy zone entries for dbr.airdrpsalert.life, and monitor the associated IP 188.114.97.3 for any new hosting activity. Correlation of internal logs for attempts to resolve or contact the domain, especially from users receiving unsolicited airdrop communications, is recommended. Adding the domain to internal threat intel feeds and sharing the indicator with downstream security platforms will help prevent credential harvesting attempts.