bcb-xautelth[.]com

This domain is flagged as a high-risk credential theft operation targeting cryptocurrency users. Analysis indicates it is designed to harvest wallet credentials, seed phrases, or exchange logins through deceptive interfaces mimicking legitimate services. The infrastructure and naming pattern suggest a focus on bypassing user vigilance through obfuscation and urgency tactics. Infrastructure analysis reveals the domain was registered on April 08, 2026, through Spaceship, Inc., and currently resolves to IP address 188.114.96.3, hosted on Cloudflare’s network (AS13335). It appears on three security blocklists and is flagged by 3 out of 95 vendors on VirusTotal. The SSL certificate is issued by Let’s Encrypt (YE2), a common tactic to appear legitimate while masking malicious intent. Detection by MetaMask and SEAL further confirms its association with crypto-focused credential theft campaigns. Mitigation requires immediate action from both users and network defenders. Users should avoid interacting with the domain, particularly if redirected from unsolicited messages or advertisements. Wallet holders must verify URLs before entering credentials and enable hardware-based or multi-factor authentication where available. Network administrators should block the domain and its resolving IP at the perimeter, monitor for internal connections, and deploy endpoint protections capable of detecting credential theft behaviors. Given the domain’s recent registration and active status, continued monitoring for related infrastructure is recommended.