# PhishDestroy domain threat record: bitfinex180.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitfinex180.com/
Machine-readable companion: https://phishdestroy.io/domain/bitfinex180.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-12 04:40:09 UTC
- Last availability or vendor check: 2026-10-21 01:16:39 UTC
- Stored record updated: 2026-10-22 14:21:14 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: 1inch

## Stored infrastructure

- Observed IP address: 172.81.98.56
- Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com
- Registration date (registry RDAP, bitfinex180.com): 2026-09-09 12:48:51 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0ba87-26bb-73d9-b79f-54e2700adc97/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitfinex180.com
- Certificate Transparency search: https://crt.sh/?q=%25.bitfinex180.com
- Web Archive lookup: https://web.archive.org/web/*/https://bitfinex180.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bitfinex180.com is a phishing domain built to pass as Bitfinex, the cryptocurrency exchange. The name pairs the real brand with a meaningless number, a common way to make a fake address look like an official mirror or promo site. It targets Bitfinex users and crypto traders. PhishDestroy first flagged it on 2026-09-12, and it has been offline since 2026-09-25, with its DNS still inactive as of 2026-10-19.

How the scam works
Exchange impersonation pages copy a brand's look to collect what protects an account. Victims are typically asked for their login email and password, and often a 2FA code, which the operators can replay right away to log in and withdraw funds. Some variants instead push fake deposit or wallet-verification steps that send crypto straight to the scammers. When last served, the page returned a "403 Forbidden" title rather than a Bitfinex-styled page. We classify it as impersonation phishing based on the domain name and independent detections.

Evidence
Eleven of 89 VirusTotal engines flagged the domain as of 2026-09-23. The flagging vendors include alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky and Netcraft. That is broad agreement among separate security vendors, not a single outlier. Spamhaus lists the domain in its DBL under the phishing category. It also appears in four AlienVault OTX threat pulses and on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-09-09 through GMO Internet Group (Onamae.com), only three days before PhishDestroy detected it. That short gap fits a domain bought specifically for a campaign. It was hosted on the JT TELECOM INTERNATIONAL network in Japan. It went dark roughly two weeks after detection, a typical lifespan for a throwaway phishing domain.

What to do
If you entered your Bitfinex login on this site, change your password from the official app or a bookmarked address, then reset two-factor authentication and end all active sessions. Check your account for API keys, withdrawal addresses or whitelist changes you did not make, and contact Bitfinex support if anything looks wrong. If you sent crypto as a "deposit" or verification payment, treat it as lost and report it. Do not pay anyone who promises to recover it. Defenders should block the domain and look for related bitfinex-plus-number lookalikes in DNS and proxy logs.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0ba87-26bb-73d9-b79f-54e2700adc97/
VirusTotal report: https://www.virustotal.com/gui/domain/bitfinex180.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitfinex180.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:25 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0ba87-26bb-73d9-b79f-54e2700adc97.png
  Captured: 2026-09-12 04:40:09 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0a335e32-f433-4f45-9c91-51fbf56ddaaf.png
  Captured: 2026-09-20 00:00:40 UTC
  Source report: https://radar.cloudflare.com/scan/0a335e32-f433-4f45-9c91-51fbf56ddaaf
  SHA-256: 295b412b8c63286078b000bbfab8b70c543878fef2cac07507ebfd8e8f52232b

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:26:24Z",
        "uuid": "01a0ba87-26bb-73d9-b79f-54e2700adc97",
        "scanned_at": "2026-09-19T16:37:02Z",
        "final_url": "https://bitfinex180.com/wap/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://bitfinex177.com/",
                "from": "https://bitfinex180.com/",
                "status": 302
            },
            {
                "to": "https://bitfinex180.com:28520/",
                "from": "https://bitfinex177.com/"
            },
            {
                "to": "https://bitfinex180.com/wap/",
                "from": "https://bitfinex180.com:28520/",
                "status": 302
            }
        ],
        "ip": "172.81.98.56",
        "domains": [
            "bitfinex177.com",
            "cdnjs.cloudflare.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.17.24.14",
            "2606:4700::6810:4f49",
            "172.67.204.230",
            "172.81.98.56"
        ],
        "asns": [
            "13335",
            "137535"
        ],
        "countries": [
            "US",
            "JP"
        ],
        "doc_hash": "1e4b7c8150bff5f21bdb39e3879dab22b9d59d949780b752886c5e11af38d5d1",
        "script_hashes": [
            "ac17ebfd2f332f03125ede8bc97ef3f81d70f54150b66597e5f42c7eef57829f",
            "d84d20b32bf61cfec5f536639e52a6c21925bb7b08ed7485ad6aa71502b317bf",
            "1b7efeb048f7db7f21ea0cd7397d5e5bbbffa031915001a386b4e18f0866d6d9",
            "24be5cc05161f5c72faf5594ba55a0fe0a94e1ad61786f25208cc663bc82f7d1",
            "878daef856219c15d7ea4aee2db7806fb60178935bdb9296c98379096b996339",
            "6e8acf0ae4a999213d22dd787ddbe45bedc09766323544c75d6825bdb8c62e3c",
            "5d206a9e8147c77248438214e185974a70f8214b30f353f12bc33192d24e1d93",
            "a3e80b4ab4f22d77f9d9348d3b668455e1e7a10684c816c951a1956b0f8e5473",
            "91c11cf709d7994441b02ada4dfda08c7bf37558da62bbe52e3db0a2744598f3",
            "3542e26499bfbd6f84fa973b3923a52ae61fee24b092bbadec76314ab282c12c"
        ],
        "globals": [
            "webpackChunkexchange",
            "clearImmediate",
            "setImmediate",
            "eventBus",
            "_PageAccelerator",
            "pageAccelerator"
        ],
        "cookies": [
            "server_session_0eb1b4d8"
        ],
        "storage_keys": [
            "@@",
            "lang",
            "vuex",
            "categoryNum"
        ],
        "tls": {
            "san": [
                "*.bitfinex177.com",
                "bitfinex177.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "bitfinex177.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-18T11:49:51Z",
            "valid_from": "2026-09-19T11:49:52Z"
        },
        "domain_age_days": 9,
        "apex_age_days": 9,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 234,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:08Z",
        "uuid": "0a335e32-f433-4f45-9c91-51fbf56ddaaf",
        "scanned_at": "2026-09-20T00:00:40Z",
        "final_url": "https://bitfinex177.com/",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "http://bitfinex180.com/",
                "status": 307
            },
            {
                "url": "https://bitfinex180.com/",
                "status": 302
            },
            {
                "url": "https://bitfinex177.com/",
                "status": 200
            }
        ],
        "dom_hash": "e385b634ec2a34081d6136f9ea71b4f27a23282b22b5ad506b44b47ece1a52d4",
        "doc_hash": "1e4b7c8150bff5f21bdb39e3879dab22b9d59d949780b752886c5e11af38d5d1",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitfinex177.com",
                "type": "A",
                "value": "172.67.204.230"
            },
            {
                "name": "bitfinex177.com",
                "type": "A",
                "value": "104.21.69.52"
            },
            {
                "name": "bitfinex177.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:cce6"
            },
            {
                "name": "bitfinex177.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:4534"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.204.230",
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "created": "2026-09-19T12:41:52Z",
            "updated": "2026-09-19T12:43:35Z",
            "expires": "2027-09-19T12:41:52Z",
            "nameservers": [
                "candy.ns.cloudflare.com",
                "lars.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:47:16Z",
        "analysis_at": "2026-10-08T06:40:05Z",
        "stats": {
            "timeout": 0,
            "harmless": 46,
            "malicious": 11,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "ESET": "suspicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "malware",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "PhishFort": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
        "created": "2026-09-09T12:48:51Z",
        "expires": "2027-09-09T12:48:51Z",
        "updated": "2026-09-09T12:49:02Z",
        "first_seen": "2026-09-10T08:18:27Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "A",
                "value": "172.81.98.56"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            }
        ],
        "dns_at": "2026-09-23T09:45:29Z",
        "jarm": "40d40d40d00040d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "bitfinex137.com",
                "bitfinex167.com",
                "bitfinex180.com",
                "bitfinex188.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6d7671060e60cdcf03a75f8c191b55ea5f8",
            "sha256": "8b1127919fd09b061732dc3cf2c1d544c009ebcea2026539ab5f275a56508171",
            "subject": "bitfinex180.com",
            "valid_to": "2026-12-18T15:43:12Z",
            "valid_from": "2026-09-19T15:43:13Z"
        },
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "registrar_iana_id": "49",
            "registrar_url": "https://internet.gmo/",
            "created": "2026-09-09T12:48:51Z",
            "updated": "2026-09-09T12:49:02Z",
            "expires": "2027-09-09T12:48:51Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a11.share-dns.com",
                "b11.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-09-08T15:00:00Z",
                "last changed": "2026-09-09T12:59:05Z",
                "registration": "2026-09-09T03:48:51Z",
                "registrar expiration": "2027-09-08T15:00:00Z",
                "last update of RDAP database": "2026-10-08T07:07:21Z"
            }
        }
    }
}
```