138btc[.]com

On 23 July 2026, investigators recorded the infrastructure associated with the domain 138btc.com. The domain was registered through Name.com, Inc. on 5 January 2025 and is currently configured with four authoritative name servers: ns1crv.name.com, ns2dky.name.com, ns3cqz.name.com, and ns4gvx.name.com. DNS resolution points to the IPv4 address 118.193.45.143, which belongs to AS135377 operated by UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED and is geolocated in Hong Kong. No TLS certificate is deployed; HTTP requests receive a 200 response code and the page title returned is the Chinese phrase “没有找到站点”, indicating a generic “site not found” message.

The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy service. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100. VirusTotal analysis shows that 11 of 95 anti‑malware engines flagged the domain, corroborating its malicious reputation. The threat classification in the intelligence set is a crypto‑related scam, and the overall risk level is marked as elevated.

The current operational status is offline, suggesting the site has been taken down or is otherwise unavailable. Because the site is not serving content, detailed assessment of the payload or phishing kit cannot be performed, and the exact tactics used to lure victims remain unknown. Defenders should continue to block 138btc.com at the DNS and proxy layers, add the associated IP address 118.193.45.143 to network‑level deny lists, and monitor for any re‑hosting of the domain or related sub‑domains. Ongoing vigilance is advised given the recent detection activity and the low trust score, which together indicate a high likelihood of continued abuse if the infrastructure is resurrected.