biagoa[.]com

This domain, biagoa.com, is flagged as an active phishing site targeting cryptocurrency users. Registered on August 26, 2025, through Amazon Registrar, Inc., it resolves to IP address 172.67.182.97, hosted on Cloudflare's infrastructure (AS13335) in the US. The domain is currently active, returning an HTTP 200 status, and its page title explicitly references 'Crypto Currency,' indicating a likely focus on fraudulent crypto-related schemes. Analysis of its SSL certificate reveals it is issued by Google Trust Services (WE1), a common but not inherently malicious provider. The domain appears on one security blocklist and is blocked by PhishDestroy, while Gridinsoft assigns it a trust score of 0/100, reflecting high-risk classification. Infrastructure analysis shows the use of Cloudflare and Cloudflare Browser Insights, alongside HTTP/3, which may be leveraged to obscure malicious activity or evade detection. One of 95 security vendors on VirusTotal flags the domain, though the specific nature of the threat remains unverified through direct analysis. Defenders should treat this domain as high-risk, particularly for users involved in cryptocurrency transactions. Recommended actions include blocking the domain at the DNS or network level, monitoring for related indicators of compromise, and alerting users to potential phishing attempts linked to this infrastructure. The exact content or mechanics of the phishing scheme are not yet confirmed, but the domain's association with cryptocurrency and its active status warrant immediate mitigation.