thebitcoinbulls[.]app

Analysis of the newly registered domain thebitcoinbulls.app indicates an active generic phishing infrastructure that entered the DNS ecosystem on July 20, 2026. The domain is hosted on Cloudflare’s network, using the authoritative name servers ali.ns.cloudflare.com and piers.ns.cloudflare.com, and resolves to the IPv4 address 104.21.2.108. Registration was performed through Namecheap Inc., a registrar frequently leveraged by threat actors for rapid domain turnover.

The domain has been observed on a single security blocklist and is currently blocked by the PhishDestroy filtering service, suggesting at least one downstream security product has flagged the host as malicious. VirusTotal records show that the domain was scanned by 91 antivirus and URL‑reputation vendors, none of which raised a detection at the time of analysis; this absence of detections should not be interpreted as a safety indicator, merely as a lack of current signatures. No public SSL certificate details, HTTP response codes, or page‑title information are available, and no Safe Browsing, Open Threat Exchange, or additional blocklist entries have been reported.

Consequently, the threat posture remains uncertain: the domain may be part of a broader phishing campaign targeting cryptocurrency‑related users, but concrete evidence of the lure or credential‑harvesting pages is not yet disclosed. Defenders should proactively block the domain and its resolved IP address at network perimeters, monitor for any future appearance in additional blocklists, and consider adding the host to internal URL‑filtering policies. Continuous re‑evaluation is advised, especially if subsequent scans reveal malicious payloads, altered DNS records, or active phishing pages.