bicatarch[.]com

This domain, bicatarch.com, is flagged as a generic phishing threat targeting users of cryptocurrency wallet platforms. Analysis indicates the site employs credential harvesting techniques, likely mimicking legitimate wallet interfaces to deceive victims into disclosing private keys or recovery phrases. While no specific drainer kit has been conclusively identified, the domain's infrastructure aligns with known phishing campaigns targeting decentralized finance (DeFi) users. The threat actor appears to focus on exploiting user trust in wallet services, a common vector for asset theft in the cryptocurrency ecosystem. Infrastructure analysis reveals the domain was registered on March 25, 2026, through HOSTINGER operations, UAB, a registrar frequently utilized by phishing operators. It resolves to the IP address 147.93.73.70, which has been associated with prior malicious activity. Detection metrics show the domain is flagged by 3 security blocklists, including MetaMask and PhishDestroy, while VirusTotal reports a detection ratio of 1/95 security vendors. The domain's creation date, combined with its rapid inclusion in blocklists, suggests a targeted and time-sensitive campaign designed to evade initial detection. As of the latest assessment, bicatarch.com has been taken offline, likely in response to blocklist inclusion and security vendor alerts. However, the elevated risk level persists due to the potential for the threat actor to re-deploy the domain or shift infrastructure to alternative addresses. Users who may have interacted with the domain are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include the domain and IP address, while security teams should investigate potential lateral movement or secondary payload delivery associated with this campaign.