resolv-airdrop[.]one

The domain resolv-airdrop.one is a phishing site engaged in brand impersonation targeting Discord users. It presented itself as a legitimate airdrop or token claim page under the title 'Resolv Claim', attempting to deceive victims into disclosing login credentials or sensitive information. No crypto drainer kit was identified in this campaign. The site is currently taken offline, but its prior activity poses an elevated risk to users who may have interacted with it.

Technical indicators confirm the malicious nature of resolv-airdrop.one. The domain was flagged by 1 of 95 VirusTotal security vendors, including Fortinet, and appears on 4 security blocklists (PhishDestroy, Polkadot, Enkrypt, and Codeesura). It was registered on August 10, 2025, through NameSilo, LLC, and resolved to the IP address 13.35.58.12, hosted on Amazon.com, Inc. infrastructure in Germany (AS16509). The SSL certificate was issued by Cloudflare TLS Issuing ECC CA 1, a common provider for both legitimate and malicious sites. Gridinsoft assigned the domain a trust score of 0 out of 100, further indicating its fraudulent intent.

Users who visited resolv-airdrop.one should immediately change their Discord passwords and enable two-factor authentication (2FA) to prevent account takeover. Monitor accounts for unauthorized activity, such as messages sent or settings altered. Report the domain to Discord’s trust and safety team via their official reporting channels. Additionally, victims can submit the domain to Google Safe Browsing, PhishTank, or other threat-intelligence platforms to aid in broader detection efforts.