fuel[.]airdrpsalert[.]life

The domain fuel.airdrpsalert.life was observed hosting a credential‑phishing campaign that leverages an airdrop‑related lure, as indicated by the associated phishing kit label “Airdrop Scam.” The site was registered through Cloudflare, Inc., and resolves to the IP address 104.21.18.150, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. No SSL certificate was presented, and the HTTP response returned a 502 Bad Gateway error, with the page title reporting “airdrpsalert.life | 502: Bad gateway.” Reputation scoring from Gridinsoft assigned the domain a zero‑out‑of‑one‑hundred trust rating, reflecting extreme suspicion. VirusTotal analysis recorded 12 detections out of 95 scanning engines, reinforcing the malicious assessment.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed. Current operational status is offline, suggesting the infrastructure has been taken down or is temporarily dormant.

Defenders should continue to enforce deny‑list rules for the host IP and domain, monitor Cloudflare‑associated address ranges for related activity, and ensure endpoint protection solutions incorporate the observed VirusTotal signatures. Because the site content could not be captured, analysts should treat any future resolution of the domain as potentially hostile and apply precautionary blocks until a thorough content review is completed.