8qyslgi[.]com

Analysis of 8qyslgi.com, created on 21 February 2026 and registered through Ultahost, Inc., indicates an active high‑risk brand‑impersonation campaign targeting Bitcoin. The domain resolves to IP 38.97.40.99, which belongs to AS174 Cogent Communications, LLC in the United States. It is served over HTTPS using a Let’s Encrypt (R13) certificate and returns HTTP 200 for the landing page whose title reads “Home - Bitcoin Investment, Bitcoin Trading, EFTs & Digital Options Trading - FxT”. Nameserver delegation includes ns1‑ns4.ultahost.com, and an MX record points to mail.8qyslgi.com. The site is currently listed on two security blocklists and has been blocked by PhishDestroy and ScamSniffer. VirusTotal reports four of ninety‑three scanners flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred. While the page title confirms the Bitcoin branding, the underlying page content has not been publicly dissected, leaving the precise phishing mechanics unknown. Defenders should immediately block the domain and its associated IP, monitor for similar registrations using the same registrar or nameserver pattern, and incorporate the observed indicators into threat‑intel feeds. Ongoing surveillance is advised to detect any evolution of the campaign or related infrastructure.