bp-portal[.]live

PhishDestroy has identified bp-portal.live as an active brand impersonation threat, specifically targeting users of a fraudulent Airdrop Scam campaign. The domain poses as a legitimate airdrop calculator under the name 'Backpack — Airdrop Calculator', but in reality it is a crypto drainer designed to steal cryptocurrency wallets and private keys. This type of threat often lures victims with promises of free tokens, then executes malicious transactions once a wallet is connected.

Technical analysis reveals several red flags. The domain was created on March 28, 2026, and resolves to IP address 188.114.96.3, which is associated with Cloudflare's infrastructure. It was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar commonly used for malicious domains. VirusTotal shows that 3 out of 95 security vendors flag this domain as malicious, and it appears on 4 security blocklists. The SSL certificate is issued by Let's Encrypt (E8), which is free and easily obtainable, adding to the suspicious profile. Notably, Google Safe Browsing has not yet blocked this site, meaning it may still be accessible to unsuspecting users.

As of now, bp-portal.live remains active and operational. PhishDestroy recommends immediate caution: do not visit the site, connect any wallet, or enter any personal information. Users who have already interacted with the domain should revoke any token approvals and transfer funds to a new wallet. While the domain is flagged by a minority of security vendors, the combination of recent creation, brand impersonation, and blocklist presence elevates the risk level. Continuous monitoring is advised, and users should verify any airdrop-related sites through official channels before engaging.