bidds[.]live

This domain, bidds.live, is flagged as a generic phishing threat specializing in cryptocurrency wallet drainers. Analysis indicates no direct brand impersonation, but the infrastructure is designed to mimic legitimate wallet interfaces to trick users into exposing private keys or signing malicious transactions. The absence of a known drainer kit suggests custom or obfuscated code, increasing the difficulty of detection by automated tools. Infrastructure analysis reveals the following technical indicators: VirusTotal detection score of 0/95, indicating no antivirus engines currently flag the domain as malicious. The domain was registered on June 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 104.21.88.186, which is part of a cloud provider's network and lacks prior malicious associations. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy. Google Safe Browsing (GSB) does not currently list the domain, and no blocklist entries were identified at the time of analysis. The domain remains active and under investigation, with no takedown or sinkholing actions reported. Response actions include continuous monitoring for changes in detection status, registrar actions, or hosting provider interventions. The remaining risk is elevated due to the domain's low detection rate, recent registration, and use of a reputable SSL issuer. Users are advised to block the domain at the network level, avoid interacting with any cryptocurrency-related prompts from this source, and verify wallet addresses independently before transactions. Security teams should prioritize monitoring for connections to 104.21.88.186 and the domain itself in proxy logs.