docs[.]liveairdrop[.]com

Analysis of docs.liveairdrop.com indicates an active high‑risk crypto‑drainer campaign. The domain was created on 21 Feb 2026 and is registered through Unstoppable Domains Inc. It resolves to 188.114.97.3, an IP owned by AS13335 Cloudflare, Inc., located in the United States. The HTTPS certificate is identified as WE1. HTTP requests receive a 301 redirect, and the page title returned is “Domain360 - Best Domain Auctions”, which does not align with the purported airdrop service and suggests the site is being used as a lure. The domain appears on one external blocklist, has a Gridinsoft trust score of 0/100, and is listed as blocked by PhishDestroy. VirusTotal reports a single detection out of 93 scanners. Nameservers are ns1.afternic.com and ns2.afternic.com. The only publicly known indicator is the “Fake Airdrop” scam type; no additional payload or phishing page details have been released. Defenders should add the domain and its resolved IP to outbound and inbound deny lists, monitor DNS queries for the domain and its nameservers, and ensure that any traffic to Cloudflare‑hosted addresses with this hash is inspected. Continuous threat‑intel feeds should be consulted for updates, and any internal alerts that reference the domain should be treated as malicious.