bigcash[.]lat

This domain, bigcash.lat, is identified as a phishing site targeting cryptocurrency users through fraudulent loan offers. Analysis of the page title, "Bitcapital – крипто кредит онлайн в USDT | Крипто позика без застави," indicates an attempt to impersonate a legitimate crypto lending platform, likely Bitcapital, to deceive victims into submitting sensitive financial information or transferring cryptocurrency under false pretenses. The site appears designed to exploit users seeking USDT-based loans without collateral, a common tactic in crypto-focused phishing schemes. No specific drainer kit signatures were detected, but the presence of tracking and analytics technologies suggests an intent to monitor user interactions for further exploitation. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which is part of a network known for hosting phishing and scam infrastructure. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. Detected technologies include jQuery, Hotjar, Google Tag Manager, Google Analytics, Facebook Pixel, and Cloudflare Browser Insights, alongside Cloudflare’s CDN and HTTP/3 support, which may be leveraged to obfuscate the site’s true origin and evade detection. As of the latest assessment, bigcash.lat has been taken offline, likely due to enforcement actions by security providers. However, the elevated risk remains due to the domain’s recent registration and the persistent threat posed by similar crypto phishing campaigns. Organizations and users are advised to block the domain and its associated IP address, monitor for related infrastructure, and implement additional verification steps for any crypto lending platforms. Continuous vigilance is recommended, as threat actors often re-deploy phishing sites under new domains or IPs following takedowns.