bgd88[.]biz

The domain bgd88.biz was registered on March 26, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently flagged as a high‑risk crypto drainer operation. The site returns an HTTP 403 status code and presents the generic page title “Just a moment…”. No additional content has been publicly disclosed, leaving the exact victim‑interaction flow unknown.

Infrastructure analysis shows that bgd88.biz resolves to the IP address 188.114.96.3, which is owned by CloudFlare, Inc. and geolocated to Canada. The domain is delegated to the CloudFlare nameservers marlowe.ns.cloudflare.com and kianchau.ns.cloudflare.com, indicating the use of CloudFlare’s CDN and DNS services. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming a valid HTTPS endpoint despite the suspicious activity. A Gridinsoft trust score of 0 out of 100 further underscores the site’s malicious nature.

Threat intelligence sources corroborate the malicious classification. AlienVault OTX lists the domain in one threat‑intel pulse, and VirusTotal reports five out of ninety‑five security vendors flagging the domain as malicious. The domain appears on a single public blocklist and is actively blocked by the PhishDestroy mitigation service. These indicators collectively support the high‑risk assessment and the designation of the site as a crypto‑draining phishing vector.

Defenders should immediately add bgd88.biz to network and endpoint blocklists, enforce DNS sinkholing for the associated IP, and monitor for any outbound connections to the CloudFlare‑hosted address. Continuous telemetry collection on attempted accesses can help refine detection rules. Given the recent registration date and active status, organizations should also audit related domains created by the same registrar for potential spillover campaigns.