# PhishDestroy domain threat record: bitfinex182.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/bitfinex182.com/ Machine-readable companion: https://phishdestroy.io/domain/bitfinex182.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-12 04:40:09 UTC - Last availability or vendor check: 2026-10-21 01:16:00 UTC - Stored record updated: 2026-10-22 14:21:14 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com - Registration date (registry RDAP, bitfinex182.com): 2026-09-09 12:48:51 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/bitfinex182.com - Certificate Transparency search: https://crt.sh/?q=%25.bitfinex182.com - Web Archive lookup: https://web.archive.org/web/*/https://bitfinex182.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview bitfinex182.com is a domain on the PhishDestroy blocklist whose name pairs the Bitfinex exchange brand with an arbitrary number, a pattern that can catch people searching for or typing the real exchange's name. PhishDestroy first saw it on 2026-09-12, only three days after it was registered. The site has been offline since 2026-09-20, and on 2026-10-19 its DNS was still inactive, so it currently does not resolve. How the scam works PhishDestroy has not assigned this domain a specific scheme, so its exact mechanism is not established. The risk comes from two things. The domain name borrows a well-known crypto exchange brand, and Spamhaus lists it as phishing. A lookalike exchange domain like this can be used to collect login credentials and 2FA codes or to solicit deposits. Anyone who interacted with it should assume that whatever they entered or sent went to an unknown third party, not to Bitfinex. Evidence On 2026-09-21, VirusTotal showed 5 of 89 engines flagging the domain: alphaMountain.ai, Fortinet, Netcraft, PhishFort and SOCRadar. That count is low, but Netcraft and PhishFort specialise in phishing and brand-abuse detection, so their verdicts carry weight. Spamhaus's domain blocklist carries it under its phishing category, DBL_PHISH. The domain also appears in 4 AlienVault OTX threat pulses, meaning other researchers had already linked it to malicious activity. Infrastructure The domain was registered on 2026-09-09 through GMO Internet Group (Onamae.com). It was flagged within three days and stopped responding eleven days after registration. That short lifespan fits a disposable domain that was abandoned once blocklists caught up, rather than a site meant to run long-term. What to do If you logged in on bitfinex182.com with credentials you also use on Bitfinex or elsewhere, change those passwords immediately and reset your 2FA. Then review your account activity and API keys for anything you did not create. If you sent funds or paid any fee there, record the transaction details and report them to your exchange and to local authorities. Do not pay anyone who promises to recover the money. Always reach exchanges through a saved bookmark rather than search results. Defenders should block the domain and watch for new registrations combining the Bitfinex name with numbers or other suffixes. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/bitfinex182.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitfinex182.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:52:22 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c19580cf-4b0c-4d4c-94d2-c5bb2fb2b6bb.png Captured: 2026-09-11 07:16:12 UTC Source report: https://radar.cloudflare.com/scan/c19580cf-4b0c-4d4c-94d2-c5bb2fb2b6bb SHA-256: f9d28948d6f6a2e0e46e97045691bfa6915aade040faea084a056086eec83373 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:33:09Z", "uuid": "c19580cf-4b0c-4d4c-94d2-c5bb2fb2b6bb", "scanned_at": "2026-09-11T07:16:12Z", "final_url": "https://bitfinex182.com/wap/", "status": 200, "redirected": "same-domain", "history": [ { "url": "https://bitfinex182.com/", "status": 302 }, { "url": "https://bitfinex182.com/wap/", "status": 200 } ], "dom_hash": "18d29348f9a133593c112dbf11f41f6681bafaf01cbe7cad1a6320155d0cde78", "doc_hash": "1cce8fa165826dcfad7622b4bd80d6888308edc99c0f142472d5424fcd56dfee", "domain_risks": [ "Newly Seen Domains", "Security Risks", "New Domains" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "bitfinex182.com", "type": "A", "value": "172.81.98.56" } ], "dnssec_valid": false, "ip": "172.81.98.56", "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-09-09T12:48:51Z", "updated": "2026-09-09T12:49:04Z", "expires": "2027-09-09T12:48:51Z", "nameservers": [ "a12.share-dns.com", "b12.share-dns.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T04:47:15Z", "analysis_at": "2026-10-12T12:03:56Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 10, "suspicious": 0, "undetected": 35 }, "detections": { "CRDF": "malicious", "G-Data": "phishing", "Sophos": "malware", "Fortinet": "phishing", "SOCRadar": "phishing", "Kaspersky": "phishing", "PhishFort": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "created": "2026-09-09T12:48:51Z", "expires": "2027-09-09T12:48:51Z", "updated": "2026-09-18T09:16:26Z", "first_seen": "2026-09-10T08:18:41Z", "dns": [ { "ttl": 600, "type": "A", "value": "172.81.98.56" }, { "ttl": 21600, "type": "NS", "value": "b.share-dns.net" }, { "ttl": 21600, "type": "NS", "value": "a.share-dns.com" }, { "ttl": 600, "type": "SOA", "rname": "master.share-dns.com", "value": "a.share-dns.com" } ], "dns_at": "2026-09-12T05:21:32Z", "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "bitfinex180.com", "bitfinex181.com", "bitfinex182.com", "bitfinex183.com", "bitfinex184.com", "bitfinex185.com", "bitfinex186.com", "bitfinex187.com", "bitfinex188.com", "bitfinex189.com" ], "issuer": "Let's Encrypt / YR2", "serial": "6eda5d75724a1795c25856a8c650a90f8", "sha256": "029089892575ced79820836eb2b1ba44863d11b160764f5c7065333494c401d7", "subject": "bitfinex185.com", "valid_to": "2026-12-09T11:51:41Z", "valid_from": "2026-09-10T11:51:42Z" }, "whois": { "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com", "registrar_iana_id": "49", "registrar_url": "https://internet.gmo/", "created": "2026-09-09T12:48:51Z", "updated": "2026-09-18T09:16:26Z", "expires": "2027-09-09T12:48:51Z", "status": [ "clientHold", "clientTransferProhibited" ], "nameservers": [ "a12.share-dns.com", "b12.share-dns.net" ], "dnssec": "unsigned" }, "rdap": { "status": [ "client transfer prohibited", "client update prohibited" ], "events": { "expiration": "2027-09-08T15:00:00Z", "last changed": "2026-09-09T12:59:05Z", "registration": "2026-09-09T03:48:51Z", "registrar expiration": "2027-09-08T15:00:00Z", "last update of RDAP database": "2026-10-12T10:55:00Z" } } } } ```