airdropwai[.]live

This domain, airdropwai.live, poses a specific brand impersonation threat by masquerading as the Across protocol's official airdrop claim page. The page title "w ai airdrop - Claim Your Tokens" is designed to trick users into connecting their cryptocurrency wallets, leading to a crypto drainer phishing kit that steals funds. The domain's elevated risk level and offline status indicate it was actively used for credential theft before being taken down.

Technical indicators confirm the malicious nature of airdropwai.live. VirusTotal flags it with 4 out of 95 security vendors detecting it as malicious. The domain was registered through Web Commerce Communications Limited and resolves to IP address 104.21.38.75. It appears on 1 security blocklist and receives a Gridinsoft trust score of 0/100. Infrastructure analysis reveals the use of Cloudflare services including Browser Insights and HTTP/3, which are commonly abused by threat actors to hide their true hosting origin.

Users who visited airdropwai.live should immediately disconnect any cryptocurrency wallets that were connected to the site. They should revoke token approvals for any contracts on this domain using a revoke tool. Affected users should also change passwords for any accounts where credentials were entered and enable two-factor authentication. Monitor cryptocurrency wallets for unauthorized transactions and report any losses to relevant authorities. Run a full security scan on the device used to access the domain.