bilence[.]com

On 24 July 2026, the domain bilence.com was observed being used in a brand‑impersonation campaign targeting the Bitcoin brand. The site’s title, "Buy/Sell Bitcoin, Ether and Altcoins | Cryptocurrency Exchange | Bilence Wallet," explicitly references Bitcoin and other cryptocurrencies, indicating a crypto‑scam motive. The domain was registered on 21 February 2026 and resolves to the IP address 188.114.97.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The TLS certificate presented is identified as "WE1," but no further certificate details are available.

The domain has been listed on two independent security blocklists, PhishDestroy and ScamSniffer, confirming that reputable threat‑intel feeds consider it malicious. VirusTotal analysis shows that the URL was submitted to 95 scanning engines, none of which returned a detection at the time of the scan; this lack of flags does not imply benign behavior. The site’s current HTTP status is reported as offline, indicating that the malicious content has been taken down or the hosting has been disrupted. However, the underlying infrastructure—Cloudflare‑protected IP and recent registration—remains a viable vector for future re‑deployment.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no page content beyond the title has been captured. Defenders should continue to monitor bilence.com for re‑appearance, enforce URL filtering based on the observed domain and associated IP, and apply brand‑monitoring rules for "Bitcoin" to detect similar impersonation attempts. Blocking the IP range owned by AS13335 for this domain, or requiring additional verification for any traffic to the host, can reduce exposure while investigations continue.