iiweb-baseiinetmx[.]vip

Analysis of iiweb-baseiinetmx.vip shows that the domain was registered on December 15 2025 through Dynadot LLC and is hosted on Amazon’s AS16509 network, resolving to 199.59.243.228 located in the United States. The authoritative nameservers ns1.dyna-ns.net and ns2.dyna-ns.net are typical of dynamic DNS services and provide no additional reputation mitigation. The site presented a page title identical to the domain and did not serve an SSL certificate, indicating HTTP‑only delivery. Automated scanning on VirusTotal recorded 14 positive detections out of 93 scanners, and Gridinsoft assigned a trust score of zero out of one hundred, confirming malicious intent.

Google Safe Browsing classified the URL as a social‑engineering threat, and the domain appears on a single external blocklist. PhishDestroy has already taken the site offline, and the current status is reported as offline. Threat intelligence attributes the payload to an “Airdrop Scam” kit, which is commonly used to solicit cryptocurrency payments under the pretext of a token airdrop. The combination of a crypto‑focused scam kit, high‑risk rating, and multiple vendor detections indicates a high confidence that the domain was used to harvest credentials or cryptocurrency wallets.

Uncertainty remains regarding the exact victim interaction flow because the page content has not been captured; only the title and kit attribution are known. Defenders should continue to block the IP address 199.59.243.228 and the domain name at DNS and proxy layers, monitor for any residual redirects to the same hosting provider, and update detection rules to flag URLs containing the “airdrop” keyword on this infrastructure. Incident response teams should also advise users to avoid providing private keys or personal information to any site lacking HTTPS that references airdrop incentives, and to report any related phishing attempts to relevant takedown services.