bty-internal[.]sbs

This domain is flagged for hosting a crypto drainer phishing operation targeting cryptocurrency users through deceptive USDT reward schemes. Analysis indicates the infrastructure is designed to lure victims with promises of high-value token rewards, a common tactic used to execute unauthorized transactions and drain digital wallets. The threat type is classified as a crypto asset drainer, which poses an elevated risk due to its direct financial impact on victims and the irreversible nature of blockchain transactions. Infrastructure analysis reveals the domain bty-internal.sbs resolves to the IP address 188.114.97.3 and is protected by Cloudflare, including HTTP/3 and HSTS implementations. The domain was registered through HOSTINGER operations, UAB, with an anomalous creation date of May 30, 2026, suggesting potential domain spoofing or backdating. VirusTotal reports 1 out of 95 security vendors flagging the domain, and it appears on one security blocklist, specifically PhishDestroy. The page title, $BOUNTY | Highest USDT Rewards, aligns with known crypto drainer lures, reinforcing the threat classification. Mitigation steps for this specific threat type include immediate blocking of the domain and associated IP address across all network security controls. Organizations should monitor for wallet addresses or smart contract interactions linked to this domain, as crypto drainers often reuse infrastructure across campaigns. Users should be educated on recognizing deceptive reward schemes, particularly those offering high-value token incentives without verifiable legitimacy. Given the domain's current offline status, historical indicators such as the IP, registrar details, and page title should be incorporated into threat intelligence feeds to prevent future abuse of similar infrastructure.