bitcoin-safe-wallet[.]com

On 25 July 2026, the domain bitcoin-safe-wallet.com was observed actively hosting a crypto‑related scam page. The site was registered on 21 February 2026 through Cloudflare, Inc., and resolves to 188.114.97.3, an IP address owned by AS13335 Cloudflare, Inc., in the United States. The TLS certificate is issued by Google Trust Services under the WE1 descriptor, indicating a valid HTTPS connection. HTTP requests return status code 200 and the server negotiates HTTP/3, confirming modern protocol support. The page title returned by the server is "비트코인 안전 지갑 - BTC 지갑 생성 및 잔고 조회 | 2026", which references Bitcoin and suggests wallet creation and balance lookup functionality.

This aligns with the classified scam type as a crypto scam impersonating Bitcoin. Technical analysis shows the presence of Sentry, Alpine.js, Naver Analytics, and jsDelivr libraries, all delivered via Cloudflare edge nodes. The domain uses the Cloudflare nameservers harlan.ns.cloudflare.com and megan.ns.cloudflare.com. Reputation metrics are extremely poor: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three external security blocklists. It is actively blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that 2 of 93 scanning engines have flagged the domain, providing additional corroboration of malicious activity. Given the high risk rating, defenders should block network traffic to both the domain and its underlying IP address, add the host to local DNS blacklists, and ensure that endpoint protection solutions are updated to include the latest blocklist signatures. Because the domain leverages Cloudflare’s public infrastructure, additional correlation with other malicious domains using the same IP or nameserver pair may be necessary to uncover broader campaign infrastructure. Continuous monitoring of the domain’s DNS records and TLS certificate for changes is recommended, as attackers frequently rotate these attributes to evade detection.