bt-yaktl[.]daftpage[.]com

The domain bt-yaktl.daftpage.com is currently classified as a high‑risk generic phishing site. Analysis shows the domain resolves to the IP address 216.150.1.129, which is hosted in the United States and belongs to AS16509 Amazon.com, Inc. The site presents an HTTP 308 permanent redirect status and serves a Let’s Encrypt certificate identified as R13, indicating the use of a valid TLS chain but offering no guarantee of legitimacy. The page title returned from the host is simply "BT," providing no further context about the intended victim brand or lure. Infrastructure fingerprints reveal a Vercel deployment: the authoritative nameservers are ns1.vercel-dns.com and ns2.vercel-dns.com, and the technology stack includes Node.js, React, Next.js, Webpack, and HSTS enforcement, all typical of modern web applications but also frequently abused by threat actors for rapid provisioning.

Registration data shows the domain was created on 24 October 2021 through the OVH, SAS registrar. Reputation services flag the domain as extremely unsafe: Scamadviser assigns a trust score of 1 out of 100, Gridinsoft scores 0 out of 100, and the domain appears on one known security blocklist. VirusTotal analysis records 18 of 93 scanning engines flagging the domain, reinforcing the malicious assessment. The site is actively blocked by the PhishDestroy feed, confirming that at least one dedicated anti‑phishing service has taken mitigation action.

While the exact phishing lure (e.g., credential‑stealing page, login clone) has not been publicly disclosed, the combination of a generic page title, low trust scores, and multiple vendor detections indicates a high probability of credential‑harvesting activity. Defenders should continue to block the domain at network perimeter controls, update URL filtering lists with the observed IP and domain, and monitor for any related sub‑domains or newly resolved IPs from the same ASN.