bicoman[.]net

PhishDestroy identifies bicoman.net as an active crypto-draining phishing domain that lures victims with a false promise of premium international documents. The page title translates to "Best international document designs," tricking users into believing the site offers legitimate templates or services. Once on the page, any connected cryptocurrency wallet can be drained via malicious JavaScript without requiring a single extra click. The domain was registered through GoDaddy on August 26, 2018, and is currently resolving to 185.227.134.82. At the time of investigation, VirusTotal flags 5 out of 95 security engines, indicating zero detection by mainstream scanners. This domain poses a high financial risk because it combines a plausible front-page theme with the low-profile registration data typical of fly-by-night scam sites. The SSL certificate from Let's Encrypt adds a veneer of legitimacy that many victims interpret as safe browsing, yet the absence of detections on VirusTotal shows how quickly such domains can evade automated filters. The creation date of August 26, 2018 suggests the domain has been dormant or benign for years before being repurposed, a red flag consistent with opportunistic domain hijacking or expired-re-registration abuse. If you visited bicoman.net: Do not connect any cryptocurrency wallet or enter personal information. Disconnect your device from the internet immediately to stop any ongoing malicious scripts. Clear your browser cache and run a reputable antivirus scan. Report the domain to your local cybercrime unit and submit it to urlscan.io and PhishDestroy for takedown. Monitor connected wallets and revoke any suspicious token approvals via Etherscan or equivalent block explorers. Forward the URL to scam-alerts@go-daddy.com so the registrar can suspend the domain.