airdrop[.]sptoken[.]live

Analysis of the domain airdrop.sptoken.live indicates an active crypto drainer campaign classified as high risk. The site returns HTTP 403 and displays the page title "רק רגע...". Infrastructure inspection shows the domain resolves to IP 188.114.97.3, which is hosted in the United States under AS13335 Cloudflare, Inc. The TLS certificate is issued by Google Trust Services (WE1), and traffic is served through Cloudflare with HTTP/3 enabled, suggesting the use of a reputable CDN to obscure origin. Reputation services provide a Scamadviser trust score of 1/100 and a Gridinsoft score of 0/100, reinforcing the malicious nature. VirusTotal reports 4 of 95 security vendors flagging the domain. The domain appears on a single blocklist and is already blocked by PhishDestroy. Registration information lists Cloudflare, Inc. as the registrar, offering no additional attribution. While the page content has not been publicly dissected, the combination of a 403 response, low trust scores, and vendor detections confirms a malicious intent targeting cryptocurrency assets. Defenders should immediately block the domain and its resolving IP, monitor for related DNS queries, and ensure that outbound connections to Cloudflare‑served endpoints are inspected for anomalous activity. Continuous re‑evaluation is recommended as threat actors may adapt the infrastructure.