btmob[.]icu

The domain btmob.icu was used to distribute the BTMOB Remote Access Trojan (RAT), specifically targeting Android devices. Despite being taken down, it was detected by 3 out of 93 vendors on VirusTotal, indicating its malicious nature. The domain was registered with NiceNIC International Group Co., Limited and hosted on an IP associated with Cloudflare, Inc.

PhishDestroy flagged btmob.icu on February 20, 2026, a day before its official registration date, showcasing our advanced detection capabilities. The page title, "BTMOB RAT Official - Buy BTMOB v1.0 to v3.4 for Android Remote Control," suggests that the site was actively promoting and selling various versions of the BTMOB RAT. This highlights the site's role in facilitating cybercriminal activities by providing tools for unauthorized access to Android devices.

The absence of an SSL certificate on btmob.icu further underscores the site's illegitimate nature, as secure sites typically use SSL to encrypt data. Although the domain is now offline, its brief activity period emphasizes the need for rapid detection and response to emerging threats. By identifying such domains early, PhishDestroy helps mitigate potential harm before they gain widespread traction.