securesprintercores[.]live

Analysis of securesprintercores.live shows a credential‑phishing campaign masquerading as a fake airdrop. The domain was registered with NameCheap, Inc. on 9 June 2025 and is currently marked offline. DNS resolution points to 92.204.41.13, an address owned by AS29066 velia.net Internetdienste GmbH in France. The nameservers dns3.afeeshost.com, ns41.afeeshost.com and ns42.afeeshost.com are publicly listed, indicating the hosting provider is Afeeshost.

The site served HTTP 200 responses and presented the page title “Blockchain | EVM_RESOLVE”, a typical lure for cryptocurrency‑related scams. TLS was provided by a Let’s Encrypt R12 certificate, confirming the use of a free, automated certificate authority. VirusTotal recorded 2 detections out of 93 scanned engines, and the domain appears on two public blocklists, specifically PhishDestroy and ScamSniffer. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious classification.

Evidence points to a fake airdrop scheme designed to harvest credentials, but the exact phishing page content has not been captured, leaving the specific lures and data‑collection mechanisms uncertain. Defenders should block the domain and its associated IP, add the observed nameservers to deny‑list rules, and monitor for any future re‑use of the same infrastructure. Network sensors should flag TLS connections to Let’s Encrypt‑issued certificates on the identified IP, and threat‑intel feeds should be updated with the domain, its registrar, and hosting details to aid rapid detection of re‑hosted variants.