sym[.]airdropsalert[.]life

The domain sym.airdropsalert.life was registered on October 17, 2025 through Dynadot LLC and is currently reported as taken offline. No TLS certificate is present, indicating the site operated over plain HTTP. DNS resolution points to the single IPv4 address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. The page title returned from the site was "airdropsalert.life," matching the observed domain pattern and suggesting an attempt to lure users with airdrop‑related promises.

Threat intelligence classifies the activity as a crypto drainer using the publicly available Airdrop Scam phishing kit. The domain appears on one security blocklist and is explicitly blocked by the PhishDestroy service. VirusTotal analysis shows that 13 of 95 scanning engines flagged the domain, reflecting a moderate detection rate across the vendor ecosystem. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the malicious assessment.

The elevated risk level is consistent with the observed infrastructure and detection metrics. Current uncertainties include the exact payload delivered to victims and whether additional command‑and‑control hosts are associated with the same IP address. Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound traffic for connections to 199.59.243.228, and update internal threat feeds with the observed indicators. Further forensic examination of any captured traffic or samples linked to the Airdrop Scam kit is recommended to confirm payload behavior and to identify potential secondary infrastructure.