dtmyyy[.]uk

dtmyyy.uk was observed on 24 July 2026 as part of a phishing investigation targeting cryptocurrency investors. The site presented the page title “BTC INVEST”, which is consistent with a campaign that attempts to lure victims into providing Bitcoin‑related credentials or funds. The domain was registered on 21 February 2026 and is currently taken offline, limiting immediate interaction but indicating a short‑lived operational window typical of opportunistic phishing infrastructure. Technical analysis shows the domain resolves to the IP address 52.52.65.61, hosted within Amazon Web Services (AS16509, Amazon.com, Inc.) in the United States.

The SSL certificate presented by the server is an Amazon‑issued RSA 2048‑bit certificate (labelled “Amazon RSA 2048 M04”), a common choice for malicious actors that rely on reputable CAs to avoid browser warnings. The domain appears on a single known security blocklist and has been actively blocked by the PhishDestroy service, confirming that at least one reputable anti‑phishing provider has identified it as malicious. VirusTotal reports indicate that the URL was submitted to 95 scanning engines, none of which returned a detection at the time of analysis; however, the absence of detections does not constitute evidence of benign behavior and should be interpreted with caution. Evidence from open‑source intelligence does not reveal a persistent landing page, login form, or any additional resources beyond the observed title.

Consequently, the exact content and tactics employed by the site remain unknown, and further collection would be required to confirm the phishing payload. Defenders are advised to continue blocking the domain at network and endpoint layers, monitor for any resurgence of the same IP address or certificate fingerprint, and incorporate the domain into threat‑intel feeds.