btc-jentis404[.]live

This domain, btc-jentis404.live, is actively serving content associated with a cryptocurrency-themed phishing operation. Registered on May 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to 104.21.54.5, an address geolocated to Canada and associated with Cloudflare infrastructure. The site returns an HTTP 200 status and presents itself under the title 'BTC-Jentis 40.4 | Official Platform for AI Assisted Trading,' a likely attempt to impersonate a legitimate trading or investment platform by leveraging terms such as 'BTC' and 'AI-assisted trading' to attract potential victims. Analysis indicates the domain is recognized in at least one threat intelligence pulse on AlienVault OTX and appears on a single security blocklist. Two out of ninety-five security vendors on VirusTotal have flagged the domain, though the absence of broader detection does not preclude its malicious intent. The domain is currently proxied behind Cloudflare nameservers (adi.ns.cloudflare.com and leland.ns.cloudflare.com), a common tactic used to obscure hosting details and evade takedown efforts. The SSL certificate is issued by Let’s Encrypt, providing HTTPS encryption that may lend an appearance of legitimacy to unsuspecting users. Infrastructure review reveals no direct ties to known phishing kits or previously identified threat actor infrastructure, though the use of Cloudflare and a recently registered domain aligns with common phishing tradecraft. The domain’s creation date, less than two months prior to this report, suggests it was established specifically for this campaign. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its resolving IP address at the network perimeter. Monitoring for related subdomains or newly registered domains with similar naming patterns (e.g., 'btc-jentis' or '404' variants) is recommended to identify potential follow-on activity.