btcbultolkens[.]com

The domain btcbultolkens.com was registered on July 06, 2025 through GoDaddy.com, LLC and currently resolves to the IPv4 address 198.12.66.123, which belongs to AS36352 HostPapa and is geolocated in the United States. The site presents a TLS certificate issued by GoDaddy TLS Intermediate CA DV, confirming that the certificate chain is valid and that the domain is using a standard SSL provider. An HTTP request to the host returns a 200 status code and the page title is "Account Suspended," indicating that the content displayed is a generic suspension notice rather than a functional service.

The domain is listed on four external security blocklists and has been actively blocked by multiple anti‑phishing services, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. VirusTotal analysis shows that two of ninety‑five security vendors have flagged the domain, providing additional corroboration of malicious intent. The threat classification associated with the domain is "Account Takeover," suggesting that attackers may be attempting to harvest credentials or hijack user accounts, although the exact target brand or service is not disclosed in the available data.

Defenders should treat the domain as high‑risk: ingest the domain into DNS sinkhole or blocklist configurations, enforce outbound traffic filtering for the resolved IP, and monitor TLS handshake logs for connections to the GoDaddy‑issued certificate. Alerting on any user‑initiated connections to the host, especially from internal workstations, will help contain potential credential‑theft attempts. Continuous re‑evaluation is advised, as the current evidence is limited to registration details, hosting infrastructure, and blocklist presence; further investigation of request patterns and any associated payloads would clarify the full scope of the campaign.