berachain-claim--sit[.]34[.]54[.]95[.]9[.]nip[.]io

The domain berachain-claim--sit.34.54.95.9.nip.io is flagged as an active airdrop scam impersonating the Berachain brand. Created on June 08, 2012, and registered through NameCheap, Inc., this domain has been operational for a significant period, suggesting a well-established campaign. The page title 'Berachain Airdrop' aligns with the phishing kit used, which is designed to lure unsuspecting users into providing sensitive information under the pretense of receiving cryptocurrency airdrops. Analysis indicates that the domain is still active and has not been flagged by VirusTotal, but it has been added to one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 further underscores the domain's high risk of being a malicious site. Infrastructure analysis reveals the use of modern web technologies such as Node.js, Envoy, React, and Next.js, indicating a sophisticated setup. The SSL certificate is issued by Google Trust Services, which could be leveraged to gain user trust. Defenders are advised to monitor this domain closely, as the lack of detection on VirusTotal does not guarantee safety. Users should be educated to verify the authenticity of airdrop offers and avoid clicking on links from untrusted sources. Additionally, security teams should consider blocking access to this domain and similar variants to protect against potential data breaches and financial losses.