bnbsniperbots[.]com

This investigation documents the infrastructure and observed activity associated with bnbsniperbots.com, a domain registered on 2026-03-04 through Porkbun LLC. The domain resolves to IP address 172.67.152.149, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated to the United States. DNS resolution is handled by grant.ns.cloudflare.com and olga.ns.cloudflare.com, indicating use of Cloudflare’s DNS and CDN services. An HTTPS connection is presented using a Google Trust Services certificate issued to the WE1 entity, and the web server returns HTTP status 200 for the landing page whose title advertises “Best BNB Sniper Bots 2026 — Ranked by Speed & Profit”. The site is associated with an “Airdrop Scam” phishing kit, and the Gridinsoft trust score is recorded as 0 out of 100. The domain appears on a single security blocklist and has been blocked by the PhishDestroy feed, confirming that at least one defensive source has flagged it as malicious. The current operational status is listed as active and the risk level remains under investigation. Evidence confirms that the domain is actively serving content and is being used in a phishing campaign targeting cryptocurrency users, as suggested by the page title and kit classification. No additional indicators such as malware payloads or credential harvesting forms have been disclosed, so the full scope of the compromise remains uncertain. Defenders should block DNS resolution to 172.67.152.149, enforce TLS inspection for connections to this certificate, and add bnbsniperbots.com to URL filtering and email security policies. Monitoring for similar Cloudflare‑hosted domains that employ the same Airdrop Scam kit is also recommended.