bktruists[.]icu

This domain, bktruists.icu, was registered on May 3, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED and remains active as of July 12, 2026. Analysis indicates it is classified as a high-risk phishing domain, with eight distinct threat intelligence pulses referencing it in security repositories. The domain resolves to IP address 172.67.222.181, which is part of Cloudflare’s infrastructure located in Canada, and is served by Cloudflare nameservers jacob.ns.cloudflare.com and kelly.ns.cloudflare.com. A Let’s Encrypt SSL certificate (serial E8) is present, which is commonly used by both legitimate and malicious sites to enable HTTPS connections. Infrastructure review shows the domain currently returns an HTTP 403 status, suggesting either restricted access or an attempt to evade detection by automated crawlers. While only three out of ninety-five security vendors on a major scanning platform flag the domain, it appears on at least one security blocklist and is actively blocked by a specialized anti-phishing service. The low detection rate may reflect limited exposure or recent activation, rather than benign intent. The combination of Cloudflare hosting, recent registration, and inclusion in multiple threat intelligence feeds supports the classification of this domain as part of a phishing operation. Defenders should treat this domain as hostile infrastructure and consider blocking resolution at the DNS level or monitoring outbound connections to its IP address. Given the use of Cloudflare, additional scrutiny of related domains sharing the same nameservers or IP range may be warranted to identify connected malicious activity.