airdrop-blockstreet[.]live

This domain, airdrop-blockstreet.live, is assessed as a high-risk crypto drainer phishing site, currently offline as of July 23, 2026. Infrastructure analysis reveals it was registered on March 14, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently associated with fraudulent domains. The site resolves to Cloudflare IP 172.67.163.40 (AS13335, US), leveraging Cloudflare’s infrastructure for anonymity and resilience, including HSTS, HTTP/3, and Cloudflare Browser Insights. The SSL certificate is issued by Let’s Encrypt (E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. Detection data indicates the domain is flagged by 13 of 91 security vendors on VirusTotal, a significant indicator of malicious activity.

It appears on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, which specialize in crypto-related threats. The page title 'Just a moment...' suggests the use of Cloudflare’s interstitial page, likely employed to filter or delay access while evading automated detection tools. The domain’s classification as a 'Crypto Scam' aligns with its association with crypto drainer activity, where victims are tricked into connecting wallets to malicious smart contracts that drain funds. Defenders should treat this domain as confirmed malicious based on its detection history, blocklist presence, and association with known crypto threat mitigators.

The use of Cloudflare nameservers (karl.ns.cloudflare.com, bristol.ns.cloudflare.com) and its hosting on a shared IP further complicates attribution but does not diminish the risk. While the site is currently offline, defenders should monitor for reactivation or related domains using similar naming conventions (e.g., 'airdrop-' prefixes) or infrastructure patterns. No evidence of a specific brand imitation is present in the available data; the scam type is strictly tied to cryptocurrency theft.