checkbnb[.]today

This domain, checkbnb.today, is identified as a cryptocurrency phishing site specifically designed to fraudulently solicit USDT (Tether) transfers. The page title, 'SEND USDT - MY,' directly indicates its intent to deceive users into sending cryptocurrency to attacker-controlled wallets. As of the latest analysis, the domain is offline, but its infrastructure and recent activity warrant elevated scrutiny. Analysis reveals that checkbnb.today was flagged by 2 of 95 security vendors on VirusTotal, a relatively low detection rate that may reflect its recent deployment. The domain was registered on November 14, 2025, through GoDaddy.com, LLC, and resolves to the IP address 77.245.76.110. Infrastructure analysis indicates the use of Ubuntu as the server operating system, Nginx as the web server, and jsDelivr for content delivery, a combination often observed in phishing campaigns. The domain appears on one security blocklist and was blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites due to its accessibility. The current status of checkbnb.today is offline, reducing immediate risk to users. However, the domain’s recent registration, low detection rate, and cryptocurrency-focused phishing tactics suggest it may reappear under similar infrastructure or domains. Organizations and individuals are advised to monitor for related indicators of compromise, including the IP address 77.245.76.110 and any domains registered through the same registrar around the same timeframe. Network-level blocking of the IP and domain is recommended for proactive defense. Users should verify cryptocurrency transaction requests through official channels and avoid interacting with unsolicited USDT transfer prompts, particularly those hosted on newly registered domains.