bscairdrop[.]live

This domain is flagged as an elevated-risk brand impersonation site specifically designed to conduct airdrop scams. Analysis indicates the infrastructure was established to deceive users into interacting with fraudulent crypto distribution schemes, likely leading to wallet compromise or unauthorized token transfers. The threat type aligns with social engineering tactics targeting decentralized finance participants. Infrastructure analysis reveals the domain bscairdrop.live was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It resolves to the IP address 188.114.97.3 and uses a Let's Encrypt SSL certificate. The domain appears on four security blocklists, including MetaMask, PhishDestroy, SEAL, and InversionDNS, and is flagged by Google Safe Browsing for SOCIAL_ENGINEERING. AlienVault OTX records the domain in one threat intelligence pulse. Despite these indicators, VirusTotal reports 0/95 detections, suggesting the campaign may still evade some automated detection systems. Mitigation requires immediate blocking of the domain and its associated IP across all network security controls. Users should be alerted to the specific threat of airdrop scams, particularly those impersonating legitimate crypto distributions. Wallet providers and exchanges should monitor for transactions linked to this domain or its IP and implement additional verification steps for users claiming airdrops from unverified sources. Security teams should review logs for connections to 188.114.97.3 and investigate any interactions with the domain, especially within the context of crypto-related activity.