elonairdrop2025[.]live

The domain elonairdrop2025.live was created on February 21, 2025 and is currently taken offline, having been blocked by PhishDestroy. Infrastructure analysis shows the site resolved to IP address 5.189.161.88, which is hosted in France by Contabo GmbH (AS51167). The hosting environment runs Apache HTTP Server with PHP, and the site presented a Let’s Encrypt R13 certificate. The page title observed during earlier scans was "Elon Musk — X Crypto Giveaway," indicating a direct attempt to leverage the Musk brand and the X platform to lure victims. The domain is registered through Dynadot LLC and uses a single nameserver configuration.

MX records point to park-mx.above.com, suggesting no legitimate mail services. Reputation signals are extremely low, with both Gridinsoft and Scamadviser assigning a trust score of 1 out of 100. Google Safe Browsing flags the domain for social engineering, and VirusTotal recorded 11 detections out of 95 scanners, reflecting a moderate consensus among security vendors that the site is malicious. AlienVault OTX lists the domain in two threat intelligence pulses, and it appears on at least one public blocklist.

The primary scam type is identified as a crypto scam, and the domain explicitly impersonates Coinbase, targeting users of that financial platform. While the site is no longer active, the combination of low trust scores, multiple vendor detections, and confirmed brand impersonation suggests a high‑risk profile. Defenders should continue to monitor the domain for any resurrection, ensure that outbound traffic to the associated IP is blocked, and add the domain and its IP to internal blocklists. Email gateways should reject messages from the listed MX host, and incident response teams should watch for related indicators of compromise that reference the "Elon Musk — X Crypto Giveaway" title or the Contabo hosting block.