btcoinmaxs[.]com

Analysis of btcoinmaxs.com, observed as an impersonation of x.com and classified as a crypto‑scam, indicates that the site was active between its registration on 11 March 2025 and its recent takedown. The domain resolves to IP 104.21.64.1, which belongs to AS13335 operated by Cloudflare, Inc., placing the hosting infrastructure in the United States. No SSL certificate was detected, meaning the site served content over plain HTTP. The single nameserver configuration and the absence of additional infrastructure signals suggest a minimal setup typical of short‑lived phishing operations.

The page title returned the string “BTC”, providing a generic reference to cryptocurrency without further context. Reputation services assign extremely low trust scores: Gridinsoft rates the domain 13 out of 100, while Scamadviser scores it 1 out of 100, reflecting a high likelihood of malicious activity. The domain appears on one external blocklist and is explicitly listed by PhishDestroy as malicious. VirusTotal scans show that one out of ninety‑five antivirus engines flagged the domain, reinforcing the suspicion despite the low detection count.

The combination of brand impersonation of x.com, the crypto‑scam label, and the unfavorable trust metrics confirms the malicious intent. Defenders should continue to block the domain at DNS and proxy layers, enforce egress filtering for the associated Cloudflare IP range, and monitor for new domains that resolve to the same IP or use similar naming patterns. Because the site is currently offline, active mitigation focuses on preventing re‑use of the infrastructure and ensuring that any residual references in email or URL‑based filters are retained until the threat actor’s activity ceases.