btcbull-snapshot[.]co

Analysis of btcbull-snapshot.co as of July 23, 2026 indicates an active high‑risk crypto‑scam infrastructure. The domain was registered on February 21, 2026 through OwnRegistrar, Inc. and is currently resolved to the Cloudflare edge address 104.21.16.64, which belongs to AS13335 Cloudflare, Inc. in the United States. Authoritative nameservers are KELLY.NS.CLOUDFLARE.COM and ARTURO.NS.CLOUDFLARE.COM, confirming the use of Cloudflare’s DNS and CDN services; HTTP/3 is also observed. The site presents an HTTP 200 response while the HTML title is “404 Not Found”, suggesting a placeholder or intentionally obscured content. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection but not mitigating the malicious intent.

Threat intelligence shows the domain appears on three security blocklists and has been flagged by multiple industry‑specific filters, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports 13 of 93 scanners labeling the domain as malicious, and AlienVault OTX references the domain in one pulse. The classification provided is “Crypto Scam”, aligning with the broader generic phishing label. Despite these indicators, the exact payload or credential‑harvesting mechanisms have not been publicly disclosed, and the specific targeting vector remains uncertain.

Defenders should immediately add btcbull-snapshot.co to network‑level deny lists, enforce DNS sink‑hole routing, and monitor outbound connections to the Cloudflare address 104.21.16.64. Email gateways should block URLs containing the domain and any URLs that resolve to the same IP range. Incident response teams should treat any authentication attempts to crypto‑related services originating from this domain as compromised, and users should be warned to avoid providing private keys or wallet credentials. Continuous re‑evaluation is advised as further intelligence may emerge.