airtimesure[.]com

The domain airtimesure.com is a phishing site engaged in brand impersonation targeting Mastercard users. It presented itself as a legitimate service under the name 'AirtimeSure' but was designed to harvest login credentials and financial information through deceptive pages. No crypto drainer kit was identified. The site is currently taken offline, though its recent activity classifies it as an elevated risk for brand impersonation and credential theft.

Technical indicators confirm airtimesure.com as malicious. As of analysis, 2 of 95 VirusTotal security vendors flagged the domain, including alphaMountain.ai and Fortinet, while Google Safe Browsing did not detect it. The domain was registered on July 08, 2025, through Atak Domain and resolved to IP address 198.23.141.202, hosted on AS36352 (HostPapa) in the US. It appeared on one security blocklist (PhishDestroy) and used an SSL certificate issued by Let's Encrypt (R12). The observed page title was 'AirtimeSure - Home', and the site returned an HTTP 200 status. Nameservers were ns1.billionvaan.com and ns2.billionvaan.com, and Gridinsoft assigned a trust score of 0/100.

Victims of airtimesure.com should immediately change any passwords entered on the site, particularly for Mastercard or linked financial accounts. Enable two-factor authentication (2FA) on all critical services to prevent unauthorized access. Monitor bank and credit card statements for unauthorized transactions, and report fraudulent activity to the impersonated brand (Mastercard) and local cybercrime authorities. The domain can be reported to Google Safe Browsing, PhishTank, or the registrar (Atak Domain) for further action.