bitbanktwd[.]net

This domain, bitbanktwd.net, is actively flagged as a high-risk phishing site impersonating a cryptocurrency exchange. Registered on May 21, 2026, through Dynadot Inc, the domain resolves to Cloudflare infrastructure (AS13335) and is hosted on IP 172.67.134.211, located in the United States. The page title '交易所演示1' translates to 'Exchange Demo 1,' suggesting an attempt to mimic legitimate trading platforms. Analysis indicates the site employs HTTP/3 and HSTS, common in modern phishing kits to appear legitimate, while also utilizing Cloudflare Browser Insights for performance monitoring. Infrastructure analysis reveals the domain uses Cloudflare nameservers (ophelia.ns.cloudflare.com and razvan.ns.cloudflare.com) and a Let's Encrypt SSL certificate (E8), which are frequently observed in phishing campaigns due to their low-cost or free availability. The site returns an HTTP 302 redirect status, a technique often used to obfuscate the final malicious destination or to evade detection. As of July 12, 2026, the domain remains active and is blocked by at least three security blocklists, including PhishDestroy and MetaMask, with 16 out of 95 security vendors on VirusTotal flagging it as malicious. The domain’s creation date, recent and aligned with typical phishing campaign timelines, further supports its classification as a fraudulent operation. While the exact brand being impersonated remains unclear, the use of Chinese-language page titles and the focus on cryptocurrency suggest targeting of users in East Asian markets. Defenders should treat this domain as hostile and prioritize blocking it at the DNS or network level. Monitoring for related infrastructure, such as shared IP addresses or SSL certificates, may uncover additional malicious domains. Given the high-risk classification and active status, organizations should also review logs for any interactions with this domain and investigate potential compromises.