bnbairdrop[.]com

This domain, bnbairdrop.com, is flagged as an active brand impersonation threat targeting cryptocurrency users through a fraudulent airdrop scheme. Analysis indicates the domain mimics Binance, a major cryptocurrency exchange, to deceive victims into participating in a fabricated token distribution event. The threat type is classified as a high-risk airdrop scam, a common tactic used to harvest credentials or deploy drainer kits designed to siphon digital assets from connected wallets. Infrastructure analysis reveals the domain was registered on March 12, 2026, through GMO Internet, Inc., a registrar frequently associated with malicious domains. It resolves to the IP address 8.217.144.225, which has been linked to other phishing campaigns in recent threat intelligence reports. The domain employs a Let's Encrypt SSL certificate, a tactic often used to lend an appearance of legitimacy. Detection metrics show limited coverage, with only 1 out of 95 security vendors on VirusTotal flagging the domain as malicious at the time of analysis. No entries were found in Google Safe Browsing or major blocklists, suggesting the campaign remains under the radar of broader detection mechanisms. As of the latest assessment, bnbairdrop.com remains active and poses a significant risk to users who may interact with the site. Response actions include recommending immediate blacklisting of the domain and IP address within enterprise security systems. Users are advised to verify airdrop legitimacy directly through official Binance channels and avoid connecting wallets to unverified platforms. The remaining risk is classified as high due to the domain's active status, low detection rate, and the potential for financial loss among targeted victims.