busd-airdrop[.]com

Analysis of busd-airdrop.com indicates a confirmed crypto drainer phishing infrastructure targeting cryptocurrency users through a fake airdrop scam. The domain, registered on July 6, 2025, via Web Commerce Communications Limited, resolved to a single IP address (3.171.214.17) hosted on Amazon.com, Inc. (AS16509) in Germany. No SSL certificate was present, increasing the risk of unencrypted data interception. The domain is flagged by four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, and holds a Gridinsoft trust score of 0/100, confirming its malicious classification.

VirusTotal detections from 5 of 95 security vendors further corroborate the domain's association with malicious activity. The domain's infrastructure, including a single nameserver, aligns with patterns observed in low-effort phishing campaigns designed to evade detection. As of the report date, the domain has been taken offline, though defenders should remain vigilant for re-registration or migration to alternative infrastructure. No specific brand impersonation was identified beyond the generic 'fake airdrop' classification, but the domain's naming convention suggests an attempt to exploit Binance USD (BUSD) users.

Defenders are advised to block the domain at the DNS and network levels, monitor for related domains using similar naming schemes (e.g., 'airdrop', 'busd'), and alert users to the risks of interacting with unverified cryptocurrency giveaways. Historical WHOIS and passive DNS data should be reviewed to identify potential connections to other malicious campaigns. Given the domain's offline status, further forensic analysis may be limited, but existing indicators should be integrated into threat intelligence feeds for proactive defense.