btc-day[.]today

PhishDestroy identifies btc-day.today as an active crypto drainer phishing domain. This domain impersonates legitimate cryptocurrency platforms to deceive users into connecting crypto wallets, ultimately draining funds. The threat actor leverages a generic drainer kit designed to harvest private keys or authorize malicious transactions upon wallet connection. Security researchers note that drainer kits often include obfuscated JavaScript payloads to bypass detection while executing unauthorized transfers. This domain was flagged with a VirusTotal detection score of 1/95 security vendors, indicating low but present malicious activity. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to IP address 188.114.97.3 and was created on April 05, 2026. The domain utilizes a Let's Encrypt SSL certificate, which may be used to establish false trust. As of current analysis, this domain remains unblocked by Google Safe Browsing and has not been widely listed on public threat intelligence feeds. As of the latest assessment, btc-day.today remains active and poses an elevated risk to cryptocurrency users. Immediate takedown or blocking is not confirmed; therefore, users should avoid interaction and report the domain via PhishDestroy. PhishDestroy continues to monitor this domain and updates its threat feed accordingly. Remaining risk is elevated due to active hosting, recent domain registration, and the presence of a drainer toolkit targeting crypto assets.