btcpay615000[.]lndyn[.]com

This domain, btcpay615000.lndyn.com, is identified as a phishing threat targeting users of cryptocurrency payment systems. The site mimics legitimate payment portals to deceive victims into entering sensitive credentials, such as wallet addresses, private keys, or login details for cryptocurrency exchanges. Once captured, this information can be used to drain digital assets or gain unauthorized access to financial accounts. The use of modern web technologies like Vue.js and Clipboard.js suggests an attempt to create a seamless, convincing user experience that lowers suspicion. Analysis indicates this domain was registered on February 21, 2026, through NameCheap, Inc., a registrar frequently abused for malicious infrastructure. It resolves to the IP address 170.75.163.78 and employs a Let's Encrypt SSL certificate to present a false sense of security. Detection metrics reveal that 1 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The low detection rate may reflect the domain's recent creation or evasion techniques, but the presence of HSTS and Nginx further suggests an attempt to emulate legitimate payment gateways. If a user visited btcpay615000.lndyn.com or entered any information on the site, immediate action is required. First, disconnect the device from the internet to prevent further data exfiltration. Next, change passwords and revoke access for any cryptocurrency wallets or exchange accounts that may have been exposed. Enable multi-factor authentication on all financial accounts to add an additional layer of security. Monitor accounts for unauthorized transactions and report the incident to relevant platforms. Users should also scan their devices for malware, as phishing sites may deploy additional payloads to maintain persistence or capture further data.