bcgyx[.]com

This domain, bcgyx.com, is actively flagged as a high-risk phishing resource targeting cryptocurrency wallet credentials. Registered on May 8, 2026, through a privacy-focused registrar, the domain remains operational as of July 12, 2026, serving content over a Cloudflare IP address (188.114.97.3) with a valid SSL certificate issued by Google Trust Services. Analysis indicates the site is designed to mimic legitimate wallet interfaces, likely prompting users to enter private keys or recovery phrases under false pretenses. The infrastructure uses Cloudflare nameservers (elisa.ns.cloudflare.com and odin.ns.cloudflare.com), a common tactic to obscure hosting origins and evade takedowns. Security vendors have detected malicious activity associated with bcgyx.com, with five out of ninety-five engines on a major scanning platform flagging the domain. It appears on three independent blocklists, including those maintained by cryptocurrency security teams, suggesting a focus on financial fraud. The domain has also been linked to a single threat intelligence pulse in a public repository, though specific campaign details remain unverified. The HTTP status code of 200 confirms the site is accessible, and its continued operation despite detection indicates persistence in targeting victims. Defenders should prioritize blocking bcgyx.com at the DNS and network levels, particularly in environments handling cryptocurrency transactions. The use of Cloudflare infrastructure complicates attribution, but the domain’s registration age (under two months) and lack of legitimate historical use support its classification as malicious. Organizations should monitor for connections to 188.114.97.3 and review logs for interactions with the domain, especially from users accessing wallet services. Given the high-risk designation, automated takedown requests should be submitted to the registrar and hosting provider, though Cloudflare’s role may delay enforcement.