# PhishDestroy domain threat record: bip3j.ee

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bip3j.ee/
Machine-readable companion: https://phishdestroy.io/domain/bip3j.ee/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-09 22:40:09 UTC
- Last availability or vendor check: 2026-10-23 02:09:59 UTC
- Stored record updated: 2026-10-23 14:20:44 UTC
- VirusTotal detections in the stored snapshot: 6/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 103.48.7.16
- Registrar in stored WHOIS data: ALMIC OÜ
- Registration date in stored WHOIS data: 2026-04-16 07:03:07 UTC

## Evidence links

- VirusTotal domain view: https://www.virustotal.com/gui/domain/bip3j.ee
- Certificate Transparency search: https://crt.sh/?q=%25.bip3j.ee
- Web Archive lookup: https://web.archive.org/web/*/https://bip3j.ee/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bip3j.ee is a suspicious domain on the PhishDestroy blocklist, first detected on 2026-08-10. No specific brand or scheme has been attributed to it, but Spamhaus lists it in its phishing category and several security vendors flag it independently. The site went offline on 2026-09-11 and was still unreachable on 2026-10-19.

How the scam works
The available evidence points to phishing rather than a confirmed wallet drainer or fake exchange. Phishing pages of this kind typically imitate a legitimate service to collect login credentials, personal details or recovery information, or to get visitors to approve actions they do not understand. Because the content was never tied to a named brand, treat anything the site asked for, whether a password, a code or a wallet connection, as potentially compromised.

Evidence
On 2026-08-20, six of 91 VirusTotal engines flagged the domain: alphaMountain.ai, Forcepoint ThreatSeeker, Fortinet, Gridinsoft, PhishFort and SOCRadar. That is a modest count, but it comes from unrelated vendors, and PhishFort specialises in brand and crypto phishing. Spamhaus DBL lists the domain as DBL_PHISH, which carries weight on its own because it feeds mail and DNS filtering for many networks. Four AlienVault OTX pulses also reference it, so other researchers have tracked it independently.

Infrastructure
The domain was served from 103.48.7.16 on the Dimension Network & Communication Limited network in Hong Kong. Its certificate came from Let's Encrypt, which gave the site a padlock in the browser but says nothing about who runs it or whether it is safe. The domain was active for about a month after PhishDestroy first saw it before going dark, a short lifespan common for throwaway phishing domains.

What to do
If you entered a password or one-time code on bip3j.ee, change that password wherever you use it and reset or re-enrol two-factor authentication on the affected account. If you typed a seed phrase or private key, assume the wallet is compromised and move funds to a new wallet created on a clean device. If you connected a wallet, review and revoke any token approvals granted during that session. Defenders should block the domain and the 103.48.7.16 address at DNS, proxy and mail gateways, and search logs for any traffic to either between 2026-08-10 and 2026-09-11.

Useful links
VirusTotal report: https://www.virustotal.com/gui/domain/bip3j.ee
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bip3j.ee
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:54:40 UTC

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T10:25:05Z",
        "uuid": "87f51de2-6bcf-4471-b34a-5cceb73a6fcc",
        "scanned_at": "2026-08-11T02:38:34Z",
        "final_url": "https://bip3j.ee/",
        "history": [
            {
                "url": "https://bip3j.ee/",
                "status": 0
            }
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bip3j.ee",
                "type": "CNAME",
                "value": "yfnh68jm.sa88566.com"
            },
            {
                "name": "bip3j.ee",
                "type": "CNAME",
                "value": "yfnh68jm.sa88566.com"
            }
        ],
        "dnssec_valid": false,
        "whois": {
            "registrar": "ALMIC OÜ",
            "created": "2026-04-16T09:03:07Z",
            "updated": "2026-04-16T09:03:07Z",
            "expires": "2027-04-17T00:00:00Z",
            "nameservers": [
                "ns1.dnsip.com",
                "ns2.dnsip.com"
            ]
        }
    }
}
```