bcb-xau[.]com

This domain, bcb-xau.com, is actively engaged in crypto wallet draining operations, a form of credential theft designed to siphon digital assets from unsuspecting users. The site mimics legitimate cryptocurrency platforms, specifically impersonating BCB, to deceive victims into entering wallet credentials or authorizing malicious transactions. Once access is granted, attackers execute unauthorized transfers, often irreversible due to blockchain immutability, resulting in financial loss for the victim. Analysis indicates bcb-xau.com was registered on April 08, 2026, through Spaceship, Inc., a registrar frequently associated with high-risk domains. The domain appears on 3 security blocklists and is flagged by 4 out of 95 security vendors on VirusTotal, including specialized crypto threat detection systems. It resolves to the IP address 104.21.26.168, hosted on Cloudflare’s infrastructure (AS13335), which is commonly used to obfuscate malicious activity behind content delivery networks. The SSL certificate, issued by Let’s Encrypt (YE2), provides minimal assurance, as it is a free and automated service often exploited by threat actors. Users who have interacted with bcb-xau.com should immediately revoke any wallet authorizations granted to the domain via their wallet’s connected sites or dApps interface. Disconnect all active sessions and transfer remaining assets to a new, secure wallet address. Monitor transaction history for unauthorized activity and report the incident to relevant blockchain explorers or security platforms. If credentials were entered, assume they are compromised and avoid reusing them across any platforms. Given the high-risk nature of this domain, no further interaction should occur, and any local references (e.g., browser bookmarks) should be removed.