blocktrust[.]top

blocktrust.top was taken offline as of the report date (July 23, 2026). The domain was registered through Gname.com Pte. Ltd. on February 21, 2026 and does not present an SSL certificate, indicating HTTP-only access. DNS resolution points to the IP address 3.111.125.108, which belongs to Amazon.com, Inc. (ASN 16509) and is geolocated in India. The site’s page title, “BLOCKTRUST-CRYPTOCURRENCY EXCHANGE”, and the classified scam type “Fake Exchange” indicate that the infrastructure was intended to impersonate a cryptocurrency trading platform to harvest credentials or funds. Google Safe Browsing flags the domain for social engineering, and eight of ninety‑three security vendors on VirusTotal have raised detections, reinforcing the malicious classification.

Independent threat‑intelligence feeds assign a Gridinsoft trust score of 1 out of 100 and list the domain on a single security blocklist. PhishDestroy has also blocked the domain. The nameservers a9.share-dns.com. and b9.share-dns.net.

are typical of shared DNS services and provide no additional attribution. While the offline status limits immediate exposure, the observed indicators suggest that the domain was actively used for phishing attempts against cryptocurrency users. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any resurgence of the same IP or nameserver patterns, and incorporate the eight VirusTotal detections into their IOC feeds. Ongoing vigilance is advised, particularly for users of cryptocurrency exchange services, to prevent credential harvesting from similar fake‑exchange sites.