btcbox[.]cc

The domain btcbox.cc was registered on March 22, 2026 through Gname.com Pte. Ltd. and resolves to the Cloudflare‑owned address 188.114.97.3, which is geolocated to Canada and tied to Cloudflare, Inc. Authoritative name servers amy.ns.cloudflare.com and cleo.ns.cloudflare.com indicate the use of Cloudflare DNS. While the site was active it presented an SSL certificate issued by Let’s Encrypt (E7), enabling encrypted HTTPS connections. Automated fingerprinting detected a Vue.js front‑end and the Marked library, confirming a modern JavaScript stack, and the page title returned simply “BTCBOX”, aligning with the reported crypto‑scam classification. Reputation signals are severe: Gridinsoft assigned a trust score of 0 out of 100, the domain appears on three security blocklists, and it has been blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal analysis shows three of ninety‑four scanners flagging the domain as malicious, reinforcing its elevated risk rating. The site is currently offline, limiting real‑time observation of any credential‑stealing forms or payloads, but the historical indicators are sufficient for defensive action. Defenders should continue to block btcbox.cc at DNS and proxy layers, enforce TLS inspection on any residual traffic, and monitor for reuse of the underlying Cloudflare IP address or associated name servers. Because the IP is shared across many legitimate services, care must be taken to avoid collateral blocking of benign sites.

Uncertainty remains regarding the specific phishing content and any victim data exfiltrated before takedown, as no page capture or login form details are available. Analysts may retrieve archived snapshots from web archives to determine the exact lure employed. Until further evidence is gathered, security teams should assume the domain was used to harvest cryptocurrency credentials or private keys and advise affected users to rotate any potentially compromised accounts.