airdropnomisma[.]live

The domain airdropnomisma.live was a crypto drainer phishing site designed to steal cryptocurrency by tricking users into connecting their wallets. Unlike typical airdrop scams, this site did not impersonate a known brand or use a publicly identified drainer kit. As of the latest verification, airdropnomisma.live has been taken offline, though it previously operated as an active threat targeting users searching for token claims.

Technical indicators show limited detection at the time of analysis: 1 of 95 VirusTotal security vendors flagged airdropnomisma.live, while Google Safe Browsing did not list it. The domain appeared on 1 security blocklist (PhishDestroy) and was registered through Web Commerce Communications Limited. It resolved to the IP address 104.21.96.1, hosted by Cloudflare (AS13335) in the US, and used an SSL certificate issued by Google Trust Services (WE1). The observed page title was 'Nomisma Airdrop - Claim Your Tokens', and the site employed Cloudflare and HTTP/3 technologies. Gridinsoft assigned a trust score of 0/100, reinforcing its classification as a cryptocurrency scam.

Users who interacted with airdropnomisma.live should immediately revoke any token approvals granted to the site via wallet management tools like Etherscan or Revoke.cash. Move remaining funds to a new, secure wallet to prevent further unauthorized transactions. Report the domain to platforms such as PhishTank, Google Safe Browsing, or local cybercrime units to aid in takedown efforts. Monitor wallet activity for signs of compromise and avoid connecting to unfamiliar sites promising token airdrops.