The domain btc-instante-v902.sbs was registered on July 29, 2026 through Spaceship, Inc. and remains active as of the report date, July 31, 2026. DNS resolution points to the IP address 188.114.97.3, and the authoritative name servers are chuck.ns.cloudflare.com and liberty.ns.cloudflare.com, indicating use of Cloudflare’s DNS infrastructure. The domain has been observed on a single security blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the classification as a phishing campaign.
VirusTotal records show that the domain was scanned by 91 security vendors, with none currently reporting a detection; this absence of detections does not imply benign intent and should be interpreted in the context of other indicators. The threat is listed as generic phishing, and the risk level is marked as under investigation. No additional metadata such as SSL certificate details, HTTP response codes, Safe Browsing status, or page title is available in the current intelligence set.
Analysts should treat the domain as malicious until further evidence suggests otherwise. Recommended defensive actions include adding the domain to deny‑list rules, monitoring DNS queries for the associated IP, and ensuring that email gateways and web proxies block traffic to the domain. Continuous re‑evaluation is advised, especially if new detection data or content analysis becomes available.