dexdrop[.]live

PhishDestroy identifies dexdrop.live as an active crypto drainer campaign leveraging brand impersonation of pump.fun and DexScreener. The domain mimics legitimate airdrop announcements to trick users into connecting wallets and signing malicious transactions. No drainer kit artifacts are publicly available yet, but the page title and context strongly suggest a generic crypto-draining payload is hosted or linked. The threat is ongoing and targets cryptocurrency users seeking airdrops or token launches.

This domain resolves to IP 188.114.96.3 and is registered via PDR Ltd. d/b/a PublicDomainRegistry.com. It was created on April 16, 2026, and secured with a Let's Encrypt SSL certificate. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, and it remains unflagged by Google Safe Browsing. No current blocklist entries were found in public feeds. These indicators suggest a newly deployed campaign with low detection coverage, increasing exposure for unwary users.

The domain remains active and serves a fraudulent airdrop page titled 'pump.fun x DexScreener Airdrop.' Immediate actions include blocking dexdrop.live at DNS and network levels, alerting cryptocurrency platforms and users, and escalating to threat intelligence teams for takedown. While the risk is currently assessed as 'under_investigation,' the combination of zero detections, recent creation, and active hosting indicates high potential for victimization. Users should avoid interacting with any airdrop links from unofficial sources and verify all URLs via official channels. Remaining risk is elevated due to low visibility and fast propagation potential in crypto communities.