alt[.]layer[.]airdropsalert[.]life

On July 23, 2026, the domain alt.layer.airdropsalert.life was flagged as a crypto drainer, a high-risk threat. Analysis indicates that the domain has been taken offline, but it remains crucial for defenders to remain vigilant. The domain was registered through Dynadot LLC on October 17, 2025, and was previously identified as hosting a phishing kit associated with an airdrop scam. Google Safe Browsing flagged the domain for social engineering, a tactic commonly used to trick users into divulging sensitive information or performing actions that compromise their security.

The domain resolves to the IP address 199.59.243.228, which is located in the United States and is part of the Amazon.com, Inc. network (AS16509). Notably, the domain is currently blocked by PhishDestroy, a known security blocklist, further emphasizing its malicious nature. Defenders should monitor for any signs of the domain coming back online and ensure that network defenses and user education are updated to protect against similar threats.

The lack of an SSL certificate on the domain suggests that it did not employ secure connections, making it easier for attackers to intercept data. The exact content of the website is not yet analyzed, but given the high number of security vendors (17 out of 95) that flagged this domain, it is evident that significant risks were associated with it. Organizations should consider adding this domain to their threat intelligence feeds to maintain a secure environment and protect against potential future attacks.