securebnb[.]live

This domain, securebnb.live, is identified as a credential-phishing resource specifically designed to deceive users into executing fraudulent USDT (Tether) transfers. Analysis indicates the site impersonates legitimate cryptocurrency transaction interfaces, likely leveraging social engineering tactics to prompt victims into disclosing wallet credentials or authorizing malicious transactions. The page title, SEND USDT, suggests a direct focus on cryptocurrency theft, a common objective in drainer kit operations, though no specific kit has been conclusively attributed to this campaign at this time. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on October 28, 2025, and resolves to the IP address 77.245.76.110. Security vendor detections on VirusTotal report 16 out of 95 engines flagging the domain as malicious, indicating moderate but not universal recognition of the threat. The domain appears on two security blocklists, and its SSL certificate is issued by Let’s Encrypt, a common but not inherently malicious certificate authority. Google Safe Browsing status is not explicitly provided, but the domain’s presence on multiple blocklists suggests prior detection by major threat intelligence platforms. As of the latest assessment, securebnb.live has been taken offline, likely in response to detection and reporting by security vendors such as PhishDestroy and ScamSniffer. While the immediate threat has been mitigated, the infrastructure remains a potential risk for future abuse, particularly if the IP or registrar is reused for similar campaigns. Users who may have interacted with the domain are advised to revoke any active wallet authorizations, monitor transaction histories for unauthorized activity, and verify the legitimacy of any cryptocurrency-related communications before engaging. Organizations should update blocklists to include this domain and its associated IP to prevent residual exposure.