bitopcoins[.]com

bitopcoins.com was registered on 21 February 2026 and resolves to the Cloudflare edge address 104.21.96.1, which is advertised as being located in the United States under AS13335. The site presented the page title “BITOPCOINS Official website” and claimed to impersonate Google, matching the credential‑phishing scam type recorded in the intelligence feed. The TLS certificate associated with the domain is identified as WE1, indicating a standard Cloudflare‑issued certificate. Early detection activity placed the domain on the PhishDestroy blocklist, and VirusTotal recorded a single positive detection among 93 scanning engines. The single vendor detection does not alone establish maliciousness, but in conjunction with the blocklist entry and explicit brand impersonation it strengthens confidence in the phishing attribution.

As of the report date (22 July 2026) the host is reported offline, and the domain has been taken down. Analysis confirms that the infrastructure leveraged legitimate Cloudflare services, a common tactic to mask malicious origins. The presence of a Google impersonation claim, combined with the credential‑phishing classification, suggests the site was likely used to harvest Google account credentials. However, the exact landing page content, form fields, and any redirected URLs have not been captured, leaving those details unverified.

Defenders should continue to block the domain at perimeter filters, add the IP address 104.21.96.1 to deny lists where appropriate, and monitor for any re‑registration or reuse of the same IP range. Security teams should update URL‑filtering rules to flag any future resolution to the same IP range and maintain vigilance for similar brand‑impersonation attempts. Users should be warned about unsolicited requests for Google credentials originating from similarly titled sites, and organizations should reinforce multi‑factor authentication to mitigate credential‑theft risk.