bitscrunchs[.]live

PhishDestroy identifies bitscrunchs.live as an active crypto drainer domain engineered to siphon cryptocurrency from unwitting users. This infrastructure masquerades as a legitimate service to trick victims into connecting wallets, where malicious scripts silently drain funds upon authorization. The site’s malicious JavaScript payloads are not yet widely detected and remain under active development, enabling threat actors to refine evasion tactics prior to mass exploitation. Immediate containment is advised to prevent financial losses.

Technical indicators confirm this domain is a high-risk threat vector. The domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently abused in bulk malicious registrations. DNS resolution points to IP 188.114.97.3, which hosts multiple suspicious domains and has low trust scores across threat intelligence platforms. Current VirusTotal analysis shows 0 detections out of 95 scanners, indicating this threat is still in its early stages of deployment and has not yet triggered widespread detection signatures. The use of a Let's Encrypt SSL certificate adds a false sense of legitimacy, tricking users into believing the site is secure.

Mitigation requires a multi-layered defensive strategy. Security teams should block traffic to bitscrunchs.live and 188.114.97.3 at the network perimeter using DNS sinkholing or firewall rules. End users must be warned against visiting the domain and advised to verify URLs prior to wallet connections. Security solutions should monitor for similar domains registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, particularly those created in April 2026, to preemptively block emerging threats. Threat hunting queries should focus on domains resolving to 188.114.97.3 with Let's Encrypt certificates and low VirusTotal detections to identify related campaigns. Immediate incident response is critical to prevent cryptocurrency theft.