btcus-exchange[.]com

PhishDestroy’s automated pipeline flagged btcus-exchange.com as an active crypto drainer phishing domain designed to siphon cryptocurrency from victims. The page mimics Biteth-exchange, a legitimate exchange name, to deceive users into connecting wallets and approving malicious token approvals. No custom drainer kit artifacts are visible on the landing page, suggesting the operators rely on standard web3 wallet interaction prompts and deceptive deposit interfaces to trigger fund transfers.

Technical indicators confirm high-risk infrastructure: the domain resolves to IPv4 address 104.21.1.232 and uses a Let’s Encrypt SSL certificate issued after domain creation on March 02, 2026. Registered through GMO Internet, Inc., the domain shows zero detections on VirusTotal (6/95 engines) and is currently flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category. These factors indicate a recently deployed campaign with minimal detection coverage.

The campaign remains active despite public exposure. Blocking the domain and IP at DNS/firewall layers is recommended to prevent access. Users should verify exchange URLs via official sources and avoid interacting with unsolicited links. Remaining risk is high due to low detection signatures and active hosting, requiring immediate defensive action and continued threat hunting.