blast-voucher[.]com

Analysis of blast-voucher.com indicates a high‑risk brand‑impersonation campaign targeting the Blast ecosystem. The domain was registered on 2025-11-07 through Tucows Domains Inc. and is served by the three Njalla nameservers (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo). DNS resolution points to IP address 2.58.56.238, which belongs to AS210558 (1337 Services GmbH) in the Netherlands. The site presents an SSL certificate issued to Internet Widgits Pty Ltd and responds with an HTTP 301 redirect, suggesting the presence of additional landing pages. The page title retrieved from the site is "Blast Mainnet Airdrop," aligning with the declared phishing kit classified as an "Airdrop Scam" and the brand target "Blast." VirusTotal analysis shows that 7 of 95 security vendors have flagged the domain, and the domain appears on two public blocklists, with explicit blocking by PhishDestroy and ScamSniffer. AlienVault OTX reports the domain in 23 threat‑intelligence pulses, reinforcing its malicious reputation. Gridinsoft assigns a trust score of 0/100, indicating no legitimate activity. While the available data confirms the domain’s use for fraudulent airdrop claims, the exact content hosted after the redirect has not been captured, leaving the full scope of the payload uncertain. Defenders should immediately block blast-voucher.com and its resolved IP address, add the domain to internal threat‑intel feeds, monitor for related DNS queries, and enforce email filtering rules that detect references to "Blast Mainnet Airdrop" to mitigate user exposure.