airdropwatch[.]live

The domain airdropwatch.live has been identified as a brand_impersonation threat targeting the Across protocol, a decentralized cross-chain bridging platform. Analysis indicates the domain was actively used to deceive users by presenting fraudulent airdrop opportunities under the guise of legitimate Across token distributions. As of the latest assessment, the domain has been taken offline, though prior activity remains a concern for security teams. Infrastructure analysis reveals the domain was flagged by 4 of 95 security vendors on VirusTotal, indicating moderate detection coverage. It resolved to the IP address 192.142.0.157 and was registered through Cosmotown, Inc., a registrar frequently associated with high-risk domains. The page title, 'Learn About SatoshiAirdrops | Discover the Latest Crypto Airdrops,' further suggests an attempt to exploit interest in cryptocurrency airdrops. Additional indicators include a Scamadviser trust score of 1/100, a Gridinsoft trust score of 0/100, and presence on one security blocklist, specifically PhishDestroy. Technologies detected on the domain include LiteSpeed and HTTP/3, which are not inherently malicious but are commonly observed in phishing infrastructure. Current status confirms the domain is offline, reducing immediate risk to end users. However, organizations should remain vigilant for similar impersonation attempts, particularly those leveraging cross-chain or airdrop themes. Security teams are advised to monitor for domains registered through high-risk registrars, low trust scores, and associations with known malicious IPs. Blocking the resolved IP (192.142.0.157) and domains with comparable naming patterns may mitigate future threats. Users should verify airdrop legitimacy through official project channels before engaging with any promotional links.