bitcoin-wallet[.]org

The domain bitcoin-wallet.org is currently active and has been classified as a high‑risk brand‑impersonation site targeting the Bitcoin brand. The site returned HTTP 200 and presents a page titled “Bitcoin Wallet (BTC) — Create Bitcoin Wallet Online. Official Website.” This title directly mirrors legitimate Bitcoin services, indicating a deliberate effort to deceive users seeking a wallet creation portal.

Infrastructure analysis shows the domain was registered on 21 February 2026 through Regional Network Information Center, JSC dba RU‑CENTER. DNS resolution points to IP 34.142.60.79, which belongs to AS396982 (Google LLC) and is geolocated in Great Britain. The domain uses Cloudflare nameservers (rory.ns.cloudflare.com, sierra.ns.cloudflare.com) and hosts its mail services on mx1.titan.email (priority 10) and mx2.titan.email (priority 20). TLS is provided by a Let’s Encrypt certificate (R12), confirming the site encrypts traffic but offering no assurance of legitimacy.

Technical fingerprinting reveals a stack built on Nginx, Bootstrap, jQuery, Moment.js, and Google Hosted Libraries, with a LiveInternet analytics tag present. VirusTotal scanned the site and recorded a single positive detection out of 95 security engines, while Gridinsoft assigned a trust score of 0 / 100. The domain appears on one external blocklist and has already been flagged by PhishDestroy, reinforcing the perception of malicious intent.

Given the explicit brand impersonation, the presence of a valid SSL certificate, and the low trust scores, defenders should block bitcoin‑wallet.org at network perimeters and update endpoint URL filtering rules. Continuous monitoring of the associated IP address and MX records is advised, as any shift in hosting or certificate issuance could indicate scaling of the campaign. Analysts should also share the indicator set with threat‑intelligence platforms to improve detection across the ecosystem.