btc25[.]us

Analysis indicates that the domain btc25.us was registered on February 21, 2026 and subsequently pointed to the IP address 104.21.9.48, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The site presented a TLS certificate identified as WE1, but the certificate's trust attributes were not disclosed. Reputation scoring from Gridinsoft assigned a zero‑point rating out of a possible 100, reflecting an extremely poor trust profile. Scanning on VirusTotal returned seven positive detections out of ninety‑three participating scanners, confirming that multiple security engines have flagged the domain as malicious.

The domain is listed on a single public blocklist and has been actively blocked by the PhishDestroy feed. The observed scam type is a crypto‑related scam, consistent with the “btc” naming pattern, although the exact lure or victim interaction has not been publicly documented. As of the report date, the domain is reported offline, which may be a temporary takedown or a deliberate shutdown by the operators.

Defenders should continue to enforce blocking of the domain and the associated Cloudflare IP address at network perimeter devices, update URL filtering rules to include btc25.us, and monitor for any resurgence of the same IP or related hostnames in future threat intelligence feeds. Continuous re‑inspection of the certificate and any new resolution data is recommended, as Cloudflare‑hosted infrastructure can be rapidly repurposed for new malicious sites. Organizations relying on automated phishing protection should ensure their safe‑browsing and anti‑phishing modules ingest the latest blocklist entries to reduce exposure to this and similar crypto‑scam campaigns.