bankcoinusdc[.]fun

This domain is under investigation for brand impersonation linked to an airdrop scam. Analysis indicates the site mimics legitimate cryptocurrency distribution events to deceive users into disclosing credentials or transferring funds. The threat type is classified as a fraudulent airdrop scheme, a common vector for crypto drainers and wallet compromise. Infrastructure analysis reveals the domain was registered on May 23, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to IP address 188.114.96.3 and employs Cloudflare with HTTP/3 support, potentially obscuring hosting origins. The page title, 'Bankcoin | Airdrop,' aligns with known impersonation tactics. As of the latest scan, VirusTotal reports 0/95 security vendor detections, though it appears on one blocklist. The domain is currently offline, but prior activity suggests it was actively used in phishing operations. Mitigation steps for this threat type include verifying airdrop legitimacy through official project channels only. Users should avoid connecting wallets or entering seed phrases on unverified platforms. Network-level protections, such as blocking the domain and associated IP (188.114.96.3), can prevent access. Organizations should monitor for similar domains registered via PDR Ltd. or using Cloudflare-hosted infrastructure with airdrop-related keywords. If interaction occurred, revoke wallet permissions and audit connected applications immediately.