btgamb[.]com

PhishDestroy identifies btgamb.com as an active crypto drainer phishing domain operating at elevated risk. This domain is engineered to deceive cryptocurrency users into connecting wallets and approving malicious token approvals, enabling direct fund extraction. The infrastructure is intentionally modern, leveraging a Let’s Encrypt SSL certificate and hosting on a cloud IP (104.21.95.70) to appear legitimate to both users and automated scanners.

This domain was flagged by PhishDestroy with the following indicators: it resolves to IP 104.21.95.70, operates under a Let’s Encrypt SSL certificate, and is detected by 10 out of 95 VirusTotal security vendors. It was registered on May 6, 2026 through Fewmoretaps OU d/b/a Trustname.com, a known registrar associated with low-trust domain registrations. The domain is currently blocked by MetaMask and SEAL and appears on 2 public blocklists, indicating confirmed malicious activity within the threat intelligence community. These factors collectively demonstrate a coordinated and rapidly deployed phishing campaign targeting crypto users.

To mitigate risk, cryptocurrency users must avoid interacting with btgamb.com entirely. Never connect wallets, approve transactions, or enter credentials on this domain. If you have already visited the site, revoke any token approvals via wallet interfaces such as Etherscan or your wallet’s approval manager. Report the domain to your wallet provider, security teams, and platforms like MetaMask or Trust Wallet. Block the domain at the network level using firewall rules or DNS filtering tools. Share threat data with PhishDestroy or similar threat intelligence feeds to aid in rapid remediation. Remain vigilant for similar domains mimicking legitimate crypto services.