obsd-drop[.]live

The domain obsd-drop.live has been identified as a high-risk entity engaged in brand impersonation, specifically targeting victims through an Airdrop Scam. It is currently active and features a page title of "Obsidian Airdrop," suggesting an attempt to mislead users into believing it is associated with a legitimate brand. The domain was created on March 22, 2026, and resolves to the IP address 104.21.64.59. This IP is associated with Cloudflare, indicating a possible effort to anonymize the hosting details of the malicious content.

Analysis of threat intelligence reveals that obsd-drop.live is featured in 23 threat intelligence pulses on AlienVault OTX, highlighting its recognition within the security community as a potential threat. The domain has been flagged by 9 out of 95 security vendors on VirusTotal, underscoring its malicious nature. Moreover, it appears on 4 established security blocklists, including those maintained by SEAL, MetaMask, PhishDestroy, and BLP-Malware, further validating its classification as a phishing threat.

Technologically, the domain utilizes Node.js, Vue.js, Nuxt.js, and Cloudflare Browser Insights, which indicates a sophisticated implementation for user engagement or data collection. The SSL certificate is issued by Let's Encrypt, a common choice among both legitimate and malicious actors, thus providing no assurance of safety. Gridinsoft assigns a trust score of 0/100 to this domain, reflecting a high level of concern regarding its legitimacy.

Defenders should take immediate action to block this domain across all network layers to prevent users from being exposed to its phishing attempts. Continuous monitoring of the domain and its associated infrastructure is advised to track any potential changes or attempts to circumvent existing security measures. Given its active status, vigilance is necessary to mitigate the risks associated with this domain and protect potential victims.