viabtc[.]com[.]de

The domain viabtc.com.de was observed hosting a page titled "ViaBTC | Войти" and is classified as a crypto‑related phishing site. Infrastructure analysis shows the domain resolves to IP 194.246.81.11, which is allocated to AS216071 SERVERS TECH FZCO in the Netherlands. The hosting stack consists of Nginx serving a Node.js application built with Vue.js and Nuxt.js, indicating a modern web framework typical of credential‑stealing portals. The SSL certificate is issued by Let’s Encrypt (R13), providing HTTPS encryption but offering no assurance of legitimacy.

Reputation services report a Gridinsoft trust score of 0 / 100 and the domain appears on a single security blocklist, confirming its malicious status. Two of ninety‑five VirusTotal scanners flagged the domain, reinforcing the suspicion despite the low detection count. PhishDestroy has already blocked the site, and the current operational status is offline, limiting real‑time interaction but leaving the underlying infrastructure intact.

The domain’s authoritative name servers are ns1.centralnic.net, ns2.centralnic.net, ns1.vdsina.com, ns2.vdsina.com, and ns3.centraln, which may be reused for related campaigns. Given the elevated risk rating, defenders should continue to deny traffic to both the domain and its associated IP, add the host to internal blocklists, and monitor the listed nameservers for newly registered subdomains that could be leveraged in future phishing attempts. Continuous observation of the AS216071 network for similar crypto‑phishing patterns is recommended to mitigate potential recurrence.