btc-novelis[.]fr

On July 24, 2026, investigators recorded a high‑risk, active brand‑impersonation campaign operating under the domain btc-novelis.fr. The infrastructure was seeded with identifier 4241b6 and targets the American Express (Amex) brand, presenting itself as a cryptocurrency service. The site’s HTML title reads "BTC 817 Novelis — Authorised site for real-time trade analysis," indicating a claim to provide real‑time trading data, but no further page content has been publicly disclosed. The domain was registered on February 21, 2026 via Dynadot LLC, and its DNS resolves to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Cloudflare serves the site using HTTP/3 and presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming the use of reputable SSL infrastructure. Nameservers leif.ns.cloudflare.com and meiling.ns.cloudflare.com are listed, reinforcing reliance on Cloudflare’s DNS services.

Reputation checks show a Gridinsoft trust score of 0 out of 100, and the site returns an HTTP 521 status, indicating that the origin server is unavailable. The domain is currently blocked by multiple threat‑mitigation services, including PhishDestroy, MetaMask, and SEAL, and appears on three external security blocklists. VirusTotal analysis records two detections out of 93 scanning engines, suggesting limited but non‑trivial malicious indicators. The campaign is classified as a crypto scam, consistent with the page title’s reference to Bitcoin trading.

While the presence of Cloudflare and a valid SSL certificate may obscure direct host attribution, the combination of a zero trust score, HTTP 521 response, and blocklist listings points to a deliberate attempt to lure victims into a fraudulent cryptocurrency workflow under the guise of Amex branding. Defenders should immediately block btc-novelis.