btexinteslogins[.]online

btexinteslogins.online was registered on September 1, 2025 through UPPERLINK LIMITED. The domain resolves to IP 50.30.32.124, which belongs to AS30083 (velia.net) and is geolocated in the United States. The authoritative nameservers are dns1.afeeshost.ltd, dns2.afeeshost.ltd, and dns3.afeeshost.com, indicating hosting under the afeef host provider. No TLS certificate is presented, meaning the site was served over plain HTTP. The only visible content retrieved before takedown was the page title “Botex International Bank,” suggesting an attempt to impersonate a financial institution.

VirusTotal analysis recorded detections from 2 of 95 security vendors, reinforcing the malicious classification. Independent reputation services assign extremely low trust scores—Scamadviser 1/100 and Gridinsoft 0/100. The domain is listed on a single public blocklist and has been actively blocked by PhishDestroy. According to internal classification, the site is a credential‑phishing campaign targeting users of Botex International Bank.

As of the report date (July 24, 2026) the site is offline, but the underlying infrastructure—IP address, registrar, and nameserver configuration—remains observable and could be reused for future campaigns. Defenders should add the domain and its associated IP address to URL filtering and DNS threat‑intelligence feeds, monitor for re‑registration of the same hostnames, and enforce TLS inspection to detect any future unencrypted login pages. Continuous observation of the AS30083 network block for anomalous traffic may also help identify re‑deployment of the same hosting environment. At present, the lack of an active web service limits direct payload analysis, so investigators should focus on the ancillary infrastructure and historical log data to trace any credential harvesting activity that may have occurred while the site was live.