sellbuy-btc[.]com

The domain sellbuy-btc.com was registered on February 21, 2026 through NameCheap, Inc. and is currently active with a high risk rating. The page title returned by the site is "SellBuy-BTC" and the domain is explicitly listed as a Binance impersonation, targeting users of the cryptocurrency exchange. The threat is classified as a crypto scam and is identified as a brand_impersonation campaign.\n\nInfrastructure analysis shows the domain resolves to IP address 172.67.176.198, which is hosted behind Cloudflare’s network (AS13335) and located in the United States. The site is served over HTTPS using a certificate issued by Google Trust Services under the WE1 identifier, and the authoritative nameservers are "donald.ns.cloudflare.com" and "elsa.ns.cloudflare.com". HTTP requests return a 200 status code and the service supports HTTP/3, indicating a modern web stack.\n\nReputation data is consistently negative: Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 7 of 95 security vendors have flagged the domain as malicious. The domain appears on one public blocklist and has been blocked by PhishDestroy, confirming that it is recognized by at least one anti‑phishing consortium. Despite these signals, the site remains reachable and continues to serve content.\n\nDefenders should immediately add sellbuy-btc.com to network and endpoint blocklists, and configure DNS filtering to deny resolution of the domain. Monitoring should be established for any outbound connections to the associated Cloudflare IP range, and alerts should be generated for HTTP/3 traffic to the IP address 172.67.176.198. Users of Binance and other cryptocurrency platforms should be warned about the impersonation attempt, and any credential or payment information submitted to the site should be assumed compromised. Continuous threat‑intel feeds should be consulted for any updates to the domain’s classification or additional indicators of compromise.