btcc3133[.]online

On July 23, 2026, the domain btcc3133.online was observed for the first time. The WHOIS record shows it was registered on July 18, 2026 through GoDaddy.com, LLC and is currently using Cloudflare nameservers dexter.ns.cloudflare.com and sunny.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is associated with a hosting provider that frequently serves malicious payloads. The domain appears on a single security blocklist and is actively listed by PhishDestroy, indicating that at least one reputable anti‑phishing feed has flagged it.

VirusTotal analysis shows that one out of ninety‑one scanned security vendors flagged the domain, confirming that some detection engines have identified it as malicious. No additional intelligence such as page title, SSL certificate details, or HTTP response codes have been released, leaving the exact content of the site unknown. The lack of public page metadata means defenders cannot rely on surface‑level indicators such as page titles or favicon hashes to confirm the threat.

However, the combination of recent registration, Cloudflare DNS, a known malicious IP, blocklist inclusion, and a positive detection by a security vendor creates a high‑confidence profile of a newly‑deployed phishing infrastructure. Defenders should update their URL filtering rules to block btcc3133.online, add the IP address 188.114.96.3 to network‑level deny lists, and monitor for any traffic to the domain or its resolver infrastructure. Endpoint protection solutions that query threat intelligence feeds should be configured to treat the domain as malicious, and security teams should consider adding the domain to internal blocklists while continuing to monitor for any further activity or additional indicators that may emerge.