bountyair[.]com

The domain bountyair.com is identified as a crypto drainer phishing site, designed to deceive users into connecting wallets and siphoning cryptocurrency assets. Analysis confirms the domain is currently offline, though prior activity targeted individuals through fraudulent USDT reward schemes. No legitimate brand impersonation was detected; instead, the site operated under a fabricated incentive program labeled $BOUNTY to lure victims. Infrastructure analysis reveals the domain was registered on February 21, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, an uncommon creation date suggesting potential domain spoofing or preemptive registration. It resolved to the IP address 172.67.172.130, a Cloudflare-hosted endpoint leveraging HSTS and HTTP/3 protocols to obscure malicious activity. The domain appears on a single security blocklist and is flagged by 4 of 95 VirusTotal vendors, indicating limited but confirmed detection. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Current status confirms the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Organizations and individuals are advised to block the domain and associated IP at the network level, monitor for wallet address reuse linked to this campaign, and conduct retrospective log analysis for connections to 172.67.172.130. Users should verify all cryptocurrency reward offers through official channels and enable hardware-based wallet protections to mitigate drainer threats. If credentials or wallet access were exposed, immediate revocation and asset migration to new addresses are recommended.