xxbtc[.]cc

This domain xxbtc.cc is currently active and is classified as a high‑risk brand‑impersonation campaign targeting Mastercard. The domain was registered on 2025-06-05 through GoDaddy.com, LLC and uses GoDaddy’s Secure Certificate Authority G2 for TLS, presenting a valid HTTPS service that returns HTTP 200. DNS resolution points to the IPv6 address 2606:4700:4407::ac40:9052, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. Authoritative name servers are ns25.domaincontrol.com and ns26.domaincontrol.com, both owned by GoDaddy. VirusTotal reports that 2 of 95 security vendors have flagged the domain, and it appears on one public blocklist as well as one AlienVault OTX pulse. The site is also listed as blocked by PhishDestroy. The observed page title reads “Get rewarded when you get started on OKX | My referral code: kk911 | OKX”, indicating a cryptocurrency referral lure, consistent with the reported crypto‑scam type. No additional content has been analyzed beyond the title. Defenders should add xxbtc.cc to network‑level deny lists, monitor DNS queries for the associated Cloudflare IP range, and enforce inspection of TLS traffic to detect the GoDaddy certificate usage. Continuous monitoring of threat‑intel feeds for new detections is recommended.