btcost[.]com

This domain, btcost.com, operates as a brand impersonation scheme designed to distribute crypto drainer malware under the guise of a trading bot. The page title, 'Explore GDDGG: The Ultimate Drops Bot for DEX Trading!', suggests an attempt to lure users into interacting with malicious decentralized exchange (DEX) tooling, likely with the intent of siphoning cryptocurrency from connected wallets. The impersonation targets 'across', a legitimate cross-chain bridging protocol, exploiting its brand recognition to gain victim trust. Analysis indicates the domain was crafted to mimic official crypto services, a common tactic in wallet-draining campaigns where users are tricked into executing unauthorized transactions or revealing private keys. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on July 21, 2025, through NameSilo, LLC, a registrar frequently associated with malicious activity due to its low verification thresholds. It resolves to the IP address 188.114.96.3, which has been linked to other phishing and malware distribution networks. Detection metrics further confirm its malicious nature: VirusTotal reports 2 out of 95 security vendors flagging the domain, while Gridinsoft assigns it a trust score of 0/100. Additionally, the domain appears on at least one security blocklist, specifically PhishDestroy, and is currently offline, suggesting takedown efforts or operational evasion. Users who visited btcost.com or interacted with its content should take immediate remediation steps. Any cryptocurrency wallets connected to the site must be considered compromised; users should transfer assets to a new wallet using a clean device and revoke all connected dApp permissions. Browser data, including cookies and cached files, should be cleared to eliminate residual tracking mechanisms. If login credentials or private keys were entered, these must be rotated across all platforms where they were reused. Monitoring for unauthorized transactions is critical, and affected users are advised to report the incident to relevant blockchain security teams for further analysis.