bounceblt[.]cc

This domain, bounceblt.cc, is identified as a fake Web3 portal designed to deceive users into interacting with fraudulent crypto services. Analysis indicates the site mimics legitimate decentralized application interfaces, likely targeting wallet credentials or transaction approvals to facilitate unauthorized fund transfers. The page title, www.www.bounceblt.cc, suggests poor operational security or an attempt to obfuscate the domain’s true purpose. No specific drainer kit signatures were confirmed, but the infrastructure aligns with known phishing campaigns targeting blockchain users. Infrastructure analysis reveals the domain was registered on June 12, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.219.160, hosted behind Cloudflare’s network, which provides HTTP/3 support and obscures the origin server. Detection engines flagged the domain in 6 out of 95 security vendor scans, while it appears on three distinct security blocklists. Despite these indicators, the domain was not listed in Google Safe Browsing at the time of assessment. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. However, residual risk remains elevated, as threat actors may re-deploy the infrastructure under a new domain or IP address. Users who interacted with the site should revoke any active wallet permissions and monitor transaction histories for unauthorized activity. Organizations are advised to block the domain, IP, and associated indicators across security controls to prevent potential re-emergence.