btcpay[.]lista18[.]com

The domain btcpay.lista18.com is identified as a credential theft phishing domain and is currently offline. This domain impersonates a well-known payment gateway to trick users into revealing sensitive login credentials. Such tactics are often used by cybercriminals to gain unauthorized access to accounts and systems.

Analysis indicates that btcpay.lista18.com was created on February 21, 2026, and resolves to the IP address 31.97.103.140. The domain is registered through NameCheap, Inc. and utilizes technologies such as Microsoft ASP.NET, Bootstrap, Vue.js, Kestrel, Moment.js, jQuery, and Clipboard.js, with support for HTTP/3. It is flagged by 6 out of 95 VirusTotal security vendors and appears on 1 security blocklist. The Gridinsoft trust score for this domain is 0/100, indicating a high level of distrust. The SSL certificate is issued by Let's Encrypt, which is a common certificate authority for domains used in malicious activities.

The domain is currently taken offline, but it is crucial to remain cautious. Security teams are advised to monitor for any signs of the domain coming back online and to update their threat intelligence databases accordingly. End users should be educated to recognize and avoid similar phishing attempts, especially those impersonating legitimate payment services. It is recommended to verify the URL and SSL certificate of any website requesting sensitive information and to report any suspicious activity to the relevant authorities or security teams.