What Gridinsoft observed on Btcic.org
A Gridinsoft threat analyst reviewed the site directly and documented the evidence behind this decision.
GMA-20260822225239-c8a15856
- Reviewed
- by Gridinsoft Threat Analyst
- Analyst finding
- Safe
- Evidence basis
- First-party site analysis External vendor intelligence: Contradictory context โ not used for this decision
The current independent first-party review supports a Safe classification for the reviewed public deployment of btcic.org. A credential-phishing object was genuinely present on the domain in 2021, but that exact path is gone, the public site was relaunched in 2026, and the fresh Gridinsoft report plus direct review of all published pages, forms, redirects, request profiles, and referenced scripts reproduced no current malicious behavior. The unsupported broad stored warning was therefore corrected; remaining external reputation labels are separately controlled context and did not determine this verdict.
Analyst findings
Review 6 documented observations View evidence
A fresh supported Gridinsoft rescan reached the current HTTPS site with HTTP 200. Before correction it retained a stored Suspicious Website domain signature dated 2025-01-08, but the current positive-signals list was empty and the report named no exact malicious URL, redirect, file, payload, exploit, or hash.
-
HTTP status
200 -
Final URL
https://btcic.org/ - Analyst observation The retained signature was dated 2025-01-08 and whitelisted=false; the fresh report returned positive_signals=[] without an exact current threat object.
The public WordPress collections exposed ten published pages and six posts in Bulgarian and English. All sixteen objects returned HTTP 200 with coherent chamber, membership, contact, and news content. The only forms were same-origin Contact Form 7 contact forms; no iframe, meta refresh, executable or archive download, fake verification prompt, or unrelated redirect was found.
- Analyst observation 10 published pages and 6 published posts were enumerated through the public WordPress collections and all 16 returned HTTP 200.
- Page element Two same-origin Contact Form 7 forms were present on /kontakti/ and /en/contact-us/ with ordinary name, email, subject, and message fields.
- Analyst observation No iframe, meta refresh, automatic download, executable or archive link, fake CAPTCHA, browser-update prompt, command-copy instruction, or unrelated destination was identified in the reviewed objects.
Desktop, crawler, and Gridinsoft request profiles received byte-identical root HTML. The mobile response differed only by the expected Astra responsive body class. Ten referenced same-origin JavaScript resources returned HTTP 200; targeted review found no current fake-update, ClickFix, command-launch, executable-delivery, or recovery-phrase behavior.
- File SHA-256 29bf7cf6da0500ba63e031405e9f5f25fcef76044f460d03a49eae9d39851f66
- Analyst observation Desktop, crawler, and Gridinsoft root responses had the same SHA-256; the mobile-only difference was the Astra ast-header-break-point responsive class.
- Analyst observation All 10 referenced same-origin JavaScript resources returned HTTP 200 and the targeted high-signal review did not reproduce a fake update, ClickFix flow, command launch, executable delivery, or recovery-phrase request.
Public urlscan records from July and August 2021 preserve an exact path on btcic.org that imitated a Roundcube webmail login and presented username and password fields. The current exact path and its parent directories return HTTP 404. No preserved specific malware file, download URL, payload, or hash was found.
- Public artifact URL https://urlscan.io/domain/btcic.org
- Screenshot SHA-256 d0ec93d5cc08efc061b4c3dd38bc82c26549e4782343d1193bd39e85bb57ae4b
-
HTTP status
404 - Analyst observation The archived exact object was a credential-phishing page, not a preserved malware sample; the current server no longer serves that object.
A Wayback capture from 2026-05-11 showed a coming-soon page, while the current WordPress API dates the public pages to 2026-08-10 and current posts to 2026-08-08 through 2026-08-22. This supports that the reviewed public site is a recent 2026 deployment distinct from the archived phishing object.
- Public artifact URL https://web.archive.org/web/20260511111742/http://btcic.org/
- Analyst observation The 2026-05-11 root capture displayed BTCIC.ORG is coming soon.
- Analyst observation The current public WordPress collection records page modification dates on 2026-08-10 and post dates from 2026-08-08 through 2026-08-22.
The apex and www host converge on the same current HTTPS deployment. Public DNS resolves the apex to 185.80.2.120, and the certificate covers btcic.org and *.btcic.org with a validity period from 2026-07-16 through 2026-10-14.
- DNS fact btcic.org and www.btcic.org resolve to 185.80.2.120; www redirects to https://btcic.org/.
- Certificate fact The reviewed certificate covers btcic.org and *.btcic.org and is valid from 2026-07-16 through 2026-10-14.
Scope and limitations
- The verdict applies to the publicly reachable btcic.org deployment reviewed at the recorded time and does not guarantee future content.
- The review did not access the private WordPress filesystem, database, administrator account, hosting panel, scheduled tasks, mail server, or server logs.
- No public form was submitted, no account or credential was used, and no object was executed.
- Public evidence confirms an exact credential-phishing page in 2021 but does not establish the initial compromise date or reconstruct every historical server response.
Help protect others by sharing this page on social media! The more people who know about btcic.org, the fewer chances they have to deceive someone else. Help others evaluate btcic.org by sharing this page on social media!