bilioa[.]com

Analysis of bilioa.com, created on September 16, 2025 and registered through Spaceship, Inc., shows a clear infrastructure supporting a crypto‑related phishing campaign. The site resolved to IP address 96.30.195.190, which belongs to AS20473 The Constant Company, LLC and is geolocated in the United States. No SSL certificate was present, indicating the site operated without HTTPS protection. The authoritative nameservers listed for the domain are launch1.spaceship.net and launch2.spaceship.net, both associated with the registrar’s infrastructure.

The page title captured during the brief observation was "$USDC Token Airdrop," matching the known phishing kit labeled as an Airdrop Scam and confirming the crypto‑scam classification. The domain appears on a single security blocklist and is explicitly blocked by PhishDestroy, reinforcing the malicious reputation. VirusTotal scans recorded five detections out of ninety‑five submitted security vendors, and AlienVault OTX referenced the domain in one threat‑intel pulse, providing additional corroboration of its malicious use. Trust scoring services reflect an extremely low reputation, with Scamadviser assigning 1/100 and Gridinsoft 0/100.

The site’s current status is offline, but historical evidence confirms it was active as a phishing vector. Defenders should continue to block bilioa.com at perimeter and DNS filtering layers, monitor the associated IP range for any resurgence, and consider adding the domain to internal threat‑intel feeds. Ongoing vigilance is advised because the underlying hosting provider and nameserver configuration could be reused for future campaigns.