rbianchi[.]info

The domain rbianchi.info was created on 3 September 2024 via PublicDomainRegistry.com (PDR Ltd.). Its authoritative name servers nspro56.hostgator.com.br and nspro57.hostgator.com.br resolve the host to 162.241.61.223, an address assigned to AS31898 belonging to Oracle Corporation in Brazil. The web server presents an Apache HTTP Server banner and serves a TLS certificate issued by Let’s Encrypt (YR1). The site is presently taken offline, but historical snapshots show a page titled “BTC Airdrop — $100 Reward for Active Traders,” which aligns with the “Airdrop Scam” phishing kit documented in open‑source repositories. The page explicitly impersonates the MetaMask brand, attempting to lure cryptocurrency users with a fake airdrop promise.

Multiple defensive feeds have flagged the domain. PhishDestroy, MetaMask’s own protection program, and the SEAL blocklist have all listed rbianchi.info as malicious. In addition, three independent security blocklists contain the domain, and VirusTotal recorded nine positive detections out of ninety‑one scanners at the time of analysis. The Gridinsoft trust engine assigned a score of zero out of one hundred, indicating a high confidence of malicious intent. The available evidence confirms a brand‑impersonation campaign targeting MetaMask users, leveraging a cryptocurrency‑airdrop lure.

No additional content has been captured, and the current offline status prevents real‑time verification of any active payloads or credential harvesting forms. Consequently, the precise mechanics of the compromise (e.g., form collection, redirection, or malware delivery) remain uncertain. Defenders should update web‑filter and DNS blocklists to include rbianchi.info, enforce TLS inspection to detect the Let’s Encrypt certificate, and monitor for any resurgence of the domain or similar patterns using the observed name‑server and IP characteristics.