btcnxt[.]ai

The domain btcnxt.ai is identified as a credential theft operation designed to harvest login credentials under the guise of a cryptocurrency review platform. Analysis indicates the site masqueraded as a legitimate source for "smart reviews" of crypto projects, likely luring victims into entering sensitive account details on spoofed forms. As of the latest assessment, the domain has been taken offline, but residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Network Solutions, LLC, and resolved to the IP address 84.32.84.157. It was flagged by 5 of 95 security vendors on VirusTotal and appeared on two security blocklists, including PhishDestroy and OISD. The site employed WordPress, MySQL, PHP, and front-end frameworks such as Bootstrap and jQuery, alongside a Let’s Encrypt SSL certificate to create a superficial appearance of legitimacy. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. Current status confirms btcnxt.ai is offline, though historical exposure may persist for users who engaged with the site. Organizations and individuals are advised to block the domain and associated IP at the network level, revoke any credentials potentially exposed through the site, and monitor for unauthorized access attempts. Users should verify the authenticity of crypto review platforms by cross-referencing official project domains and avoiding sites with recent creation dates or low trust scores. Security teams are encouraged to update detection rules to include this domain and its infrastructure indicators in threat intelligence feeds.