btc[.]web3-trade[.]net

The domain btc.web3-trade.net was registered on 21 February 2026 via NameSilo, LLC and is hosted behind Cloudflare (AS13335). DNS resolution points to IP 104.21.43.177, located in the United States. The domain lacks an SSL/TLS certificate, leaving the HTTPS handshake unencrypted. HTTP probing returned a page whose title is “Tokenize”, but no further content has been captured before the site was taken offline. Threat intelligence categorises the site as a crypto‑related phishing operation; the scam type is listed as “Crypto Scam”.

VirusTotal analysis shows that 1 of 93 AV engines flagged the domain, indicating at least one vendor detected malicious behavior. Independent blocklist services have also listed the domain: PhishDestroy actively blocks it, and it appears on a second security blocklist. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high confidence in its malicious nature. The nameservers henry.ns.cloudflare.com and jo.ns.cloudflare.com are standard Cloudflare delegations and do not, by themselves, imply wrongdoing.

Current monitoring confirms the host is offline, which may be an intentional takedown by the operator or a temporary removal by the hosting provider. Defenders should add the domain and its resolved IP address to their deny lists, enforce outbound filtering for connections to 104.21.43.177, and monitor for similar sub‑domains that reuse the same registrar or Cloud‑flare name servers. Because the site presented a generic “Tokenize” title without further visible branding, automated detection may miss variants; therefore, threat‑intel feeds that reference the domain, the IP block, or the associated blocklist identifiers should be ingested into SIEM correlation rules. Continuous re‑resolution checks are advisable, as the attacker could reactivate the domain or switch to a new host under the same registrar.