# Phishing sites impersonating Bitfinex PhishDestroy has recorded 48 phishing domains impersonating Bitfinex since 2025-08-02, 1 of them in the last 30 days. The most used registrars are NiceNIC and MarkMonitor; the most common TLDs are .com and .dev. Open Bitfinex only from its official app or a saved bookmark. 48Domains, all time 1Last 30 days 17Online at last check 4Confirmed takedowns ## New domains in the last 90 days Bitfinex phishing domains detected per day: 12 from 2026-07-25 to 2026-10-22; peak 3. ## How to tell a fake Bitfinex site Words most often added to the brand in reported domains: plasma, edgeone, transfer, duplicate, disabled, plasmachecks, authorize, primequotex, qfsnanoxleger, bitfinexdesktopapp. - Type the address yourself or use a bookmark; phishing links for Bitfinex arrive through ads, search results, direct messages and fake support accounts. - Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters. - Bitfinex will never ask for your seed phrase. Read every wallet signature: approvals, Permit and setApprovalForAll requests can hand over your assets. Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check). ## Latest Bitfinex phishing domains The 48 most recently detected domains impersonating Bitfinex Domain | First detected | Status at last check | Registrar | [bitfinextaxdocument.com](https://phishdestroy.io/domain/bitfinextaxdocument.com/) | 2026-10-08 | Online | Dynadot | [authorise-transfer-dp2yby7u8ziv.edgeone.dev](https://phishdestroy.io/domain/authorise-transfer-dp2yby7u8ziv.edgeone.dev/) | 2026-09-09 | Online | MarkMonitor | [xn--btfnex-p9ac.com](https://phishdestroy.io/domain/xn--btfnex-p9ac.com/) | 2026-09-01 | Online | GoDaddy.com | [authorize-transfer-dp8gjz5m9o4i.edgeone.dev](https://phishdestroy.io/domain/authorize-transfer-dp8gjz5m9o4i.edgeone.dev/) | 2026-08-31 | Online | MarkMonitor | [payment-account-dpcz51xt64hv.edgeone.dev](https://phishdestroy.io/domain/payment-account-dpcz51xt64hv.edgeone.dev/) | 2026-08-28 | Online | MarkMonitor | [bitfinexkr.com](https://phishdestroy.io/domain/bitfinexkr.com/) | 2026-08-26 | Online | Gabia | [authorize-transfer-dpfviqvao6vv.edgeone.dev](https://phishdestroy.io/domain/authorize-transfer-dpfviqvao6vv.edgeone.dev/) | 2026-08-25 | Online | MarkMonitor | [legacy-bitfundex.today](https://phishdestroy.io/domain/legacy-bitfundex.today/) | 2026-08-24 | Online | NICENIC | [bitwinex.io](https://phishdestroy.io/domain/bitwinex.io/) | 2026-07-28 | Online | GoDaddy.com | [boommoment.com](https://phishdestroy.io/domain/boommoment.com/) | 2026-07-27 | Online | NAMECHEAP | [opticryptomarkets.com](https://phishdestroy.io/domain/opticryptomarkets.com/) | 2026-07-27 | Online | Network Solutions | [getbfinexorg.com](https://phishdestroy.io/domain/getbfinexorg.com/) | 2026-07-27 | Online | Registrar.eu | [h5.bitfinn.com](https://phishdestroy.io/domain/h5.bitfinn.com/) | 2026-06-18 | Online | Chengdu Fly-Digital Technology | [plasmalabs.us](https://phishdestroy.io/domain/plasmalabs.us/) | 2026-06-15 | Online | GoDaddy.com | [appplasma.sbs](https://phishdestroy.io/domain/appplasma.sbs/) | 2026-05-02 | Offline | Porkbun | [app-plasma.sbs](https://phishdestroy.io/domain/app-plasma.sbs/) | 2026-05-02 | Online | Porkbun | [bitfinax.wixstudio.com](https://phishdestroy.io/domain/bitfinax.wixstudio.com/) | 2026-04-06 | Online | Wix Studio | [fxaxm.com](https://phishdestroy.io/domain/fxaxm.com/) | 2026-03-09 | Offline | GMO Internet | [bitfinexprofit.com](https://phishdestroy.io/domain/bitfinexprofit.com/) | 2026-02-26 | Offline | — | [distribution-plasma.com](https://phishdestroy.io/domain/distribution-plasma.com/) | 2026-02-26 | Offline | PublicDomainRegistry.com | [auth-s1.co](https://phishdestroy.io/domain/auth-s1.co/) | 2026-02-26 | Taken down | NameSilo | [bitfinexc.win](https://phishdestroy.io/domain/bitfinexc.win/) | 2026-02-24 | Offline | Gname.com | [bitfinex.kids](https://phishdestroy.io/domain/bitfinex.kids/) | 2026-02-24 | Offline | Gname.com | [check-plasma.app](https://phishdestroy.io/domain/check-plasma.app/) | 2026-02-13 | Unknown | NiceNIC | [bitfinexw.asia](https://phishdestroy.io/domain/bitfinexw.asia/) | 2026-02-01 | Offline | Gname.com | [tmall990.cyou](https://phishdestroy.io/domain/tmall990.cyou/) | 2026-01-06 | Offline | Dynadot | [thespkflareline.com](https://phishdestroy.io/domain/thespkflareline.com/) | 2026-01-04 | Taken down | Cosmotown | [www-plasma.app](https://phishdestroy.io/domain/www-plasma.app/) | 2025-12-20 | Taken down | NiceNIC | [plasma.mom](https://phishdestroy.io/domain/plasma.mom/) | 2025-12-07 | Offline | Porkbun | [eligible-plasma.com](https://phishdestroy.io/domain/eligible-plasma.com/) | 2025-11-19 | Unknown | NiceNIC | [plasma.credit](https://phishdestroy.io/domain/plasma.credit/) | 2025-10-28 | Taken down | Cloudflare | [coinstake.info](https://phishdestroy.io/domain/coinstake.info/) | 2025-10-19 | Online | TT-20230331 (ASN: 51167) | [amazingbestearning.com](https://phishdestroy.io/domain/amazingbestearning.com/) | 2025-10-19 | Offline | NameSilo | [plasmachainlive.com](https://phishdestroy.io/domain/plasmachainlive.com/) | 2025-10-09 | Offline | OwnRegistrar | [plasma.allocation-invest.com](https://phishdestroy.io/domain/plasma.allocation-invest.com/) | 2025-10-01 | Offline | PublicDomainRegistry.com | [plasmareward.com](https://phishdestroy.io/domain/plasmareward.com/) | 2025-10-01 | Offline | OwnRegistrar | [plasmachecks.com](https://phishdestroy.io/domain/plasmachecks.com/) | 2025-10-01 | Offline | OwnRegistrar | [plasmachecks.xyz](https://phishdestroy.io/domain/plasmachecks.xyz/) | 2025-10-01 | Unknown | NiceNIC | [plasmachecker.xyz](https://phishdestroy.io/domain/plasmachecker.xyz/) | 2025-09-30 | Unknown | NiceNIC | [proposal-plasma.com](https://phishdestroy.io/domain/proposal-plasma.com/) | 2025-09-27 | Unknown | NiceNIC | [plasmalive.xyz](https://phishdestroy.io/domain/plasmalive.xyz/) | 2025-09-26 | Unknown | NiceNIC | [bitfinexes.com](https://phishdestroy.io/domain/bitfinexes.com/) | 2025-09-09 | Offline | Amazon Registrar | [duplicate-disabled-4485.invalid](https://phishdestroy.io/domain/duplicate-disabled-4485.invalid/) | 2025-09-09 | Offline | Amazon Registrar | [bitfinexdesktopapp.com](https://phishdestroy.io/domain/bitfinexdesktopapp.com/) | 2025-09-09 | Offline | ERANET | [qfsnanoxleger.co](https://phishdestroy.io/domain/qfsnanoxleger.co/) | 2025-09-07 | Offline | Cosmotown | [primequotex.com](https://phishdestroy.io/domain/primequotex.com/) | 2025-08-09 | Offline | Web Commerce Communications | [duplicate-disabled-517.invalid](https://phishdestroy.io/domain/duplicate-disabled-517.invalid/) | 2025-08-08 | Offline | PublicDomainRegistry.com | [piltradcom.com](https://phishdestroy.io/domain/piltradcom.com/) | 2025-08-02 | Offline | NameCheap | [All 48 Bitfinex reports](https://phishdestroy.io/domain/?brand=Bitfinex) ## Where they are registered and hosted ### Registrars - [NiceNIC](https://phishdestroy.io/registrar/nicenic/)7 - [MarkMonitor](https://phishdestroy.io/registrar/markmonitor/)4 - [PublicDomainRegistry.com](https://phishdestroy.io/registrar/publicdomainregistry-pdr/)3 - [OwnRegistrar](https://phishdestroy.io/registrar/ownregistrar/)3 - [Gname.com](https://phishdestroy.io/registrar/name-com/)3 - [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)3 - [Cosmotown](https://phishdestroy.io/registrar/cosmotown/)2 - [Amazon Registrar](https://phishdestroy.io/registrar/amazon-registrar/)2 ### Top-level domains - [.com](https://phishdestroy.io/tld/com/)23 - [.dev](https://phishdestroy.io/tld/dev/)4 - [.xyz](https://phishdestroy.io/tld/xyz/)3 - [.invalid](https://phishdestroy.io/tld/invalid/)2 - [.co](https://phishdestroy.io/tld/co/)2 - [.app](https://phishdestroy.io/tld/app/)2 - [.sbs](https://phishdestroy.io/tld/sbs/)2 - [.info](https://phishdestroy.io/tld/info/)1 ### Hosting networks - CLOUDFLARENET, US13 - Cloudflare, Inc.6 - AS-COLOCROSSING, US4 - Amazon.com, Inc.4 - ACE4 - ACE-AS-AP ACE, SG2 - Sollutium-NL SOLLUTIUM EU Sp z.o.o., PL2 - CLOUDFLARENET - Cloudflare, Inc., US2 ## Related - [Typosquatting](https://phishdestroy.io/glossary/typosquatting/) - [Homoglyph](https://phishdestroy.io/glossary/homoglyph/) - [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/) - [Wallet drainer](https://phishdestroy.io/glossary/wallet-drainer/) - [Seed phrase phishing](https://phishdestroy.io/glossary/seed-phrase-phishing/) - [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) - [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator) - [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action) - [All impersonated brands](https://phishdestroy.io/brand/) Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Bitfinex; share of all PhishDestroy reports: 0.02%. Canonical: https://phishdestroy.io/brand/bitfinex/