mexicanuncairdrop[.]pro

PhishDestroy identifies mexicanuncairdrop.pro as an active brand impersonation domain designed to lure users into crypto scams under the guise of an airdrop. The threat level remains under investigation due to minimal detection coverage despite clear malicious intent. This domain specifically mimics legitimate airdrop campaigns to deceive users into connecting wallets or providing private keys, a common tactic in cryptocurrency fraud. Security teams should treat this as a high-risk impersonation threat pending further analysis. This domain was flagged by PhishDestroy’s automated pipeline and exhibits multiple red flags. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on April 24, 2026, mexicanuncairdrop.pro resolves to IP 104.21.63.251 and leverages a Let’s Encrypt SSL certificate to appear legitimate. Current VirusTotal analysis shows 5 out of 95 engines detecting the domain, indicating it has not yet been widely blacklisted. The combination of a newly registered domain, low detection rate, and impersonation of a high-value crypto service suggests active deployment in low-volume scam campaigns. No confirmed presence on public blocklists has been observed as of the latest scan. To mitigate exposure to this threat, users should avoid interacting with any links or content associated with mexicanuncairdrop.pro. Cryptocurrency users, in particular, should verify all airdrop campaigns through official project websites using bookmarked links, never via unsolicited messages or unfamiliar domains. Security teams are advised to block the domain at the DNS and network levels, monitor for associated IP traffic, and update threat intelligence feeds to include this entry using the unique seed identifier d9d20b. Early detection remains critical given the domain’s current low detection profile and active registration status.