airdropaggregata[.]live

Analysis of airdropaggregata.live shows that the site is currently offline, indicating that the operators have taken the domain down or are temporarily disabling it. The domain resolves to the IP address 104.21.38.182, which belongs to Cloudflare’s network (AS13335) and is hosted in the United States. Cloudflare services are confirmed by the presence of two Cloudflare‑owned nameservers, gabriel.ns.cloudflare.com and jamie.ns.cloudflare.com, and the site supports HTTP/3, suggesting recent infrastructure provisioning. The SSL certificate is issued by Google Trust Services under the WE1 label, providing a valid TLS chain but offering no indication of legitimacy, as the certificate is publicly available to any domain using Cloudflare’s SSL termination. VirusTotal records indicate that one of ninety‑five security vendors flagged the domain, reinforcing the suspicion of malicious activity. The site is listed on a single security blocklist and has been explicitly blocked by PhishDestroy, a known anti‑phishing service.

A Gridinsoft trust score of 0 out of 100 further reflects the extreme lack of trustworthiness. The registrar information shows registration through Web Commerce Communications Limited, a provider often used for disposable or rapidly churned domains. The page title retrieved from the domain, “Aggregata Airdrop – Claim Your Tokens,” together with the classification of the underlying kit as an “Airdrop Scam,” confirms that the site was designed to masquerade as a token distribution offering. The brand target is identified as “base,” indicating that the perpetrators are attempting to leverage the reputation of the Base platform to lure victims. No additional content, screenshots, or visual analysis are available because the site is offline.

Defenders should continue to block the IP address 104.21.38.182 at the network perimeter and add the fully qualified domain name to DNS‑based blacklists.