btcpay[.]forgily[.]com

This domain, btcpay.forgily.com, operates as a crypto wallet drainer designed to steal cryptocurrency credentials and private keys. Analysis indicates the site mimics legitimate BTCPay Server infrastructure, using deceptive payment interfaces to trick victims into authorizing malicious transactions. The threat specifically targets users of cryptocurrency wallets by presenting fake payment requests or wallet connection prompts, which, when interacted with, execute unauthorized transfers of digital assets to attacker-controlled addresses. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on February 21, 2026, through NameCheap, Inc., and is currently offline. It appears on one security blocklist, while VirusTotal reports 5 out of 95 security vendors flagging it as malicious. The site resolves to IP address 170.75.167.152 and employs technologies such as Bootstrap, Vue.js, Nginx, and jQuery, which are commonly used in both legitimate and fraudulent web applications. The HTTP 429 response suggests either automated probing or defensive measures against detection tools. Users who visited btcpay.forgily.com should immediately revoke any wallet connections or transaction approvals granted to the site. Disconnect all connected dApps and review recent transactions for unauthorized activity. If credentials or private keys were entered, transfer remaining funds to a new, secure wallet and monitor the compromised wallet for suspicious outflows. Reset passwords for any accounts where the same credentials may have been reused. Report the incident to relevant cryptocurrency platforms and security teams for further mitigation.