air[.]cryptbnb[.]live

The domain air.cryptbnb.live was observed resolving to the IP address 198.23.193.170, which is hosted in the United States under Autonomous System 36352 operated by HostPapa. The IP registration record lists a corporate customer identifier CC-198-23-193-168-29, confirming the same ASN. TLS termination is provided by a Google Trust Services certificate (WE1), indicating the use of Google‑managed HTTPS infrastructure. An HTTP request to the site returned a 403 status code, and the domain is currently listed as taken offline, which suggests the malicious content has been removed or the hosting service has terminated access. The page title retrieved during the brief live period was "Air Cryptbnb.

| CFD Trading — Trading on Stocks, Gold, Oil, Indices," implying a fraudulent attempt to lure victims into CFD or cryptocurrency trading schemes. The intelligence explicitly tags the site as a crypto‑related scam and notes that it impersonates the brand "across," although no further brand‑specific artifacts were captured. VirusTotal analysis recorded five detections out of ninety‑five scanners, indicating a moderate consensus among security vendors that the domain is malicious. The domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy service.

Scamadviser assigned a trust score of 11 out of 100, reinforcing the low credibility assessment. DNS queries returned NS_NOT_FOUND, suggesting the authoritative nameserver information is either missing or deliberately obfuscated. Defenders should add air.cryptbnb.live to network and endpoint blocklists, monitor traffic to the associated IP range (198.23.193.0/24), and update intrusion‑prevention signatures to flag the observed TLS certificate chain and HTTP 403 response pattern.