airdropnansen[.]live

airdropnansen.live was observed hosting a page titled “Nansen Airdrop – Claim Your Tokens”. The site is associated with a crypto drainer campaign that uses the publicly available “Airdrop Scam” phishing kit. The domain was registered on 5 May 2025 through Web Commerce Communications Limited dba WebNic.cc and resolves to 172.67.207.48, an address owned by Cloudflare (AS13335) located in the United States. The SSL certificate presented is identified as “WE1”. Gridinsoft assigned a trust score of 0 / 100, indicating a lack of reputational confidence.

The domain appears on one security blocklist and has been blocked by the PhishDestroy feed. VirusTotal analysis shows 5 of 93 scanners flagging the domain as malicious. The site is currently offline, as indicated by the “taken offline” status. The risk rating is elevated, and the scam type is recorded as a Crypto Scam. Analysis confirms that the infrastructure is typical of fast‑flux‑style phishing operations that leverage Cloudflare’s CDN to obscure origin.

The presence of a known phishing kit and the low trust score suggest the site was designed to harvest cryptocurrency wallet credentials. No additional infrastructure such as command‑and‑control servers is disclosed in the available data, leaving the broader campaign footprint uncertain. Defenders should add 172.67.207.48 to network deny lists, monitor for future resolutions of airdropnansen.live, and enforce endpoint rules that block the “Airdrop Scam” kit signatures. Updating URL filtering with the exact page title can help catch residual redirects, and continued monitoring of the registrar WebNic.cc for new domains exhibiting similar patterns is recommended.