btcevo2[.]com

The domain btcevo2.com has been identified as a confirmed brand impersonation scam targeting Bitcoin users. Analysis indicates the site falsely promises returns of 30-45% monthly, a common tactic in fraudulent investment schemes. The domain is currently offline, though prior activity suggests it was actively used to deceive victims into transferring cryptocurrency under the guise of high-yield investment opportunities. Infrastructure analysis reveals the domain was registered on February 21, 2026, through GoDaddy.com, LLC, and resolved to the IP address 51.79.138.185. Detection data shows the domain was flagged by 3 of 95 security vendors on VirusTotal, with additional blocking by PhishDestroy and OISD, totaling appearances on 2 security blocklists. The site employed technologies including Node.js, Nginx, React, OpenResty, Next.js, Mailgun, and Webpack, which are consistent with modern phishing infrastructure. A Gridinsoft trust score of 0/100 further corroborates its malicious classification. The page title, "BitcoinEvolux - Receive 30-45% Returns Monthly," explicitly targets users seeking cryptocurrency investment opportunities. The domain has since been taken offline, though similar infrastructure may reappear under different names. Organizations and individuals are advised to block the domain and associated IP address at the network level. Users should be educated on recognizing investment scams, particularly those promising unrealistic returns. Security teams are recommended to monitor for newly registered domains with similar naming patterns or infrastructure characteristics, as threat actors frequently reuse tactics and hosting providers.