biva[.]cc

This domain, biva.cc, is flagged as an active crypto wallet phishing site targeting users with fraudulent wallet-draining schemes. Analysis indicates the absence of any legitimate brand association, with infrastructure likely linked to a generic phishing kit designed to harvest cryptocurrency credentials. No specific drainer kit fingerprint has been confirmed, but the domain exhibits behavior consistent with automated phishing frameworks used in recent wallet-compromise campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 188.114.96.3 and was registered on May 08, 2026, through Dynadot Inc. Detection metrics show a VirusTotal score of 16/95 security vendors flagging the domain as malicious. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is referenced in one AlienVault OTX threat intelligence pulse. Gridinsoft trust score is 0/100, and Google Safe Browsing status remains unconfirmed at this time. Current status indicates the domain remains active and operational, posing an elevated risk to users. Response actions include immediate blocking at the DNS and network levels, with recommended endpoint protection updates to include this domain in denylists. Despite existing detections, the domain continues to resolve, suggesting persistence in malicious infrastructure. Users are advised to avoid interaction, verify wallet addresses independently, and monitor transaction histories for unauthorized activity. Remaining risk is classified as elevated due to the domain's recent registration, active resolution, and confirmed malicious intent.