btcai[.]vip

Analysis of btcai.vip, a domain created on May 13, 2024 and registered through GoDaddy.com, LLC, indicates that it is being used for a crypto‑related brand impersonation campaign. The site resolved to IP address 206.238.196.20, which is hosted in Hong Kong under ASN 399077 (Tcloudnet). No SSL certificate was observed, meaning the site operated over plain HTTP only. The page title returned by the server was "BTCAI -", matching the domain name and reinforcing the likelihood of a deceptive presentation.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on one security blocklist, confirming that at least one external sinkhole or filtering service has flagged it. PhishDestroy also listed the domain as blocked, and a VirusTotal scan involving 95 antivirus engines reported no detections, a result that does not imply safety given the low trust score and blocklist presence. The domain’s current HTTP status is offline, limiting direct observation of content; however, the combination of a newly created domain, lack of TLS, a zero trust rating, and inclusion on a blocklist strongly suggests malicious intent aligned with the declared "Crypto Scam" classification. Uncertainty remains regarding the exact payload or phishing pages that may have been served before takedown, as no visual or functional analysis is available.

Defenders should immediately block traffic to 206.238.196.20 and add btcai.vip to outbound and inbound deny lists. Continuous monitoring of the hosting ASN and any newly observed subdomains under the same registrar is advised, as threat actors often recycle infrastructure. Organizations should also audit DNS logs for queries to btcai.vip and correlate any related authentication attempts with potential credential‑theft incidents.