biitcooinsds[.]cc

This domain, biitcooinsds.cc, is flagged as a high-risk cryptocurrency drainer phishing site targeting users through deceptive wallet interaction prompts. Analysis indicates the site operates under the guise of a cryptocurrency service, employing social engineering tactics to trick victims into authorizing malicious transactions that siphon digital assets from connected wallets. The threat type aligns with a broader trend of crypto drainer campaigns, where attackers exploit weak authentication mechanisms in decentralized finance (DeFi) platforms. Infrastructure analysis reveals the domain was registered on February 25, 2026, through NameSilo, LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 143.92.60.42, hosted under AS152194 (CTG Server Limited) in Hong Kong, a network segment with a history of hosting phishing infrastructure. The domain appears on three security blocklists and is actively blocked by multiple threat intelligence feeds. Detection metrics from VirusTotal show 10 out of 95 security vendors flagging the domain as malicious, with a Let's Encrypt SSL certificate (R12) providing a false sense of legitimacy. The page title, 'Cryptons,' mimics legitimate cryptocurrency platforms to enhance credibility. Mitigation against this threat requires immediate action from both end-users and network administrators. Users should revoke any suspicious wallet authorizations granted to the domain via blockchain explorers or wallet management tools. Network-level protections, such as DNS filtering or firewall rules, should block resolution to 143.92.60.42 and related domains registered through NameSilo with similar creation timelines. Organizations should monitor for connections to the IP and domain, particularly in environments where cryptocurrency transactions occur. Given the domain's current offline status, continuous monitoring for re-emergence under altered infrastructure is advised, as threat actors frequently reuse registrar and hosting providers for subsequent campaigns.