btcvellante75[.]it

Analysis of btcvellante75.it indicates the site is a confirmed crypto‑related phishing operation. The domain was registered through Dynadot LLC on 11 March 2026 and immediately pointed to the Cloudflare edge address 104.21.56.101, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. The TLS certificate presented is issued by Google Trust Services under the WE1 root, confirming that the site used a legitimate HTTPS certificate despite its malicious purpose. The page title returned by the server is “Suspected phishing site | Cloudflare”, and the HTTP response code is 403, suggesting the host has taken the site offline after detection.

Reputation data shows the domain appears on three independent security blocklists and is listed in an AlienVault OTX pulse, providing early community‑wide awareness of the threat. Google Safe Browsing categorises the URL as a social‑engineering risk, and VirusTotal reports that five of ninety‑four scanning engines flagged the domain, reinforcing the malicious assessment. The site is also blocked by PhishDestroy, MetaMask, and the SEAL phishing‑filtering project, indicating that multiple anti‑phishing tools have taken preventive action. The observed indicators point to a crypto‑scam campaign, although the exact phishing template, targeted wallet addresses, or victim interaction flow have not been disclosed publicly.

Defenders should continue to block the domain at network perimeter devices, update DNS‑based blacklists with the listed IP and nameservers (lindsey.ns.cloudflare.com, ignat.ns.cloudflare.com), and monitor for any future re‑registration attempts. Incident response teams that have observed related malicious traffic should correlate logs against the IP 104.21.56.101 and the registration timestamp to identify potential compromise. Because the site is currently offline, ongoing surveillance of the associated Cloudflare infrastructure is advised to detect possible migration to new IPs or domains.