botcoinevent[.]org

On 24 July 2026, an investigation was performed on the domain botcoinevent.org, which is flagged as a generic phishing threat with an elevated risk rating. The domain was registered on 27 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com. DNS resolution points to the IP address 188.114.96.3, hosted under the Cloudflare network (AS13335) and located in the United States. The domain uses the Cloudflare authoritative nameservers buck.ns.cloudflare.com and georgia.ns.cloudflare.com.

No SSL/TLS certificate was observed for the host, indicating that the site does not serve content over HTTPS. A passive scan recorded the page title "x.com/"; however, the site is currently taken offline, so the complete page content could not be retrieved for deeper analysis. The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reported a single positive detection out of ninety‑three scanning engines, confirming that at least one vendor identified malicious behavior.

The combination of recent registration, use of Cloudflare’s free DNS service, lack of encryption, and presence on multiple blocklists suggests intentional infrastructure setup for phishing. Uncertainty remains regarding the specific phishing payload or credential‑harvesting mechanisms because the site is not accessible for inspection. Defenders are advised to add botcoinevent.org to deny‑list rules, monitor DNS queries for the associated IP address, and consider updating endpoint and web‑filter signatures that reference the observed blocklist entries. Continuous observation of the domain’s registration status and any re‑appearance on threat‑intel feeds is recommended to detect potential re‑use.