# PhishDestroy domain threat record: bitfinex184.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitfinex184.com/
Machine-readable companion: https://phishdestroy.io/domain/bitfinex184.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-12 04:40:09 UTC
- Last availability or vendor check: 2026-10-21 01:16:00 UTC
- Stored record updated: 2026-10-22 14:21:14 UTC
- VirusTotal detections in the stored snapshot: 5/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored infrastructure

- Observed IP address: 172.81.98.56
- Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com
- Registration date (registry RDAP, bitfinex184.com): 2026-09-09 12:48:51 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08efa-e918-74c9-8eb0-8e8c44f77327/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitfinex184.com
- Certificate Transparency search: https://crt.sh/?q=%25.bitfinex184.com
- Web Archive lookup: https://web.archive.org/web/*/https://bitfinex184.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bitfinex184.com was a phishing page that copied the cryptocurrency exchange Bitfinex, down to a page title reading simply "Bitfinex". It targeted Bitfinex customers who might land on a lookalike address through a search ad, a message or a mistyped link. PhishDestroy first flagged it on 2026-09-12. The site has been offline since 2026-09-20 and its DNS was still inactive on 2026-10-19.

How the scam works
Exchange impersonation pages show a convincing copy of the real sign-in screen. Whatever the visitor types, including email, password and often a one-time 2FA code, goes straight to the operators. With those details they can log into the genuine Bitfinex account, change security settings and withdraw funds before the owner notices. The number tacked onto the brand name is a common trick that makes the domain look like an official mirror or regional site.

Evidence
On 2026-09-21, five of 89 VirusTotal engines flagged the domain: alphaMountain.ai, Fortinet, Netcraft, PhishFort and SOCRadar. That count is low, but several of these vendors specialise in phishing and brand-abuse detection, so their agreement carries weight. Spamhaus lists the domain in its DBL as phishing, and four AlienVault OTX threat pulses reference it. PhishDestroy carries it on its blocklist.

Infrastructure
The domain was registered on 2026-09-09 through GMO Internet Group (Onamae.com) and was caught three days later. That short gap is typical of throwaway phishing domains set up for a brief campaign. It resolved to 172.81.98.56, an address on JT Telecom International's network (registered in Singapore) and geolocated to Japan. A valid TLS certificate was in place, so the browser padlock gave visitors no warning.

What to do
If you entered Bitfinex credentials on this site, change your Bitfinex password immediately from the official app or a bookmarked address. Reset your 2FA, and change the password anywhere else you reused it. Check your account's login history, active sessions, API keys and withdrawal whitelist, and remove anything you don't recognise. Contact Bitfinex support if you see unauthorised activity. Defenders should block the domain and its hosting IP, search mail and proxy logs for visits since 2026-09-09, and treat Bitfinex-branded domains with numeric suffixes as suspect.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08efa-e918-74c9-8eb0-8e8c44f77327/
VirusTotal report: https://www.virustotal.com/gui/domain/bitfinex184.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitfinex184.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:26 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08efa-e918-74c9-8eb0-8e8c44f77327.png
  Captured: 2026-09-12 04:40:09 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/6cef2ea3-8090-4876-838e-ef4bcfdba4a7.png
  Captured: 2026-09-14 07:16:40 UTC
  Source report: https://radar.cloudflare.com/scan/6cef2ea3-8090-4876-838e-ef4bcfdba4a7
  SHA-256: 4a4948c2c9659be0ea4be38134ea9fbf5b509456661b661bc1e8972bf12a86d6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:26:25Z",
        "uuid": "01a08efa-e918-74c9-8eb0-8e8c44f77327",
        "scanned_at": "2026-09-11T05:40:13Z",
        "final_url": "https://bitfinex184.com/wap/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://bitfinex184.com/wap/",
                "from": "https://bitfinex184.com/",
                "status": 302
            }
        ],
        "ip": "172.81.98.56",
        "domains": [
            "cdnjs.cloudflare.com"
        ],
        "ips": [
            "104.17.25.14",
            "172.81.98.56"
        ],
        "asns": [
            "13335",
            "137535"
        ],
        "countries": [
            "JP"
        ],
        "doc_hash": "1cce8fa165826dcfad7622b4bd80d6888308edc99c0f142472d5424fcd56dfee",
        "script_hashes": [
            "ac17ebfd2f332f03125ede8bc97ef3f81d70f54150b66597e5f42c7eef57829f",
            "623378e5155bdf540962f1e718b269b8db12db1a2ee42d74e1d1483853017281",
            "1b7efeb048f7db7f21ea0cd7397d5e5bbbffa031915001a386b4e18f0866d6d9",
            "24be5cc05161f5c72faf5594ba55a0fe0a94e1ad61786f25208cc663bc82f7d1",
            "878daef856219c15d7ea4aee2db7806fb60178935bdb9296c98379096b996339",
            "6e8acf0ae4a999213d22dd787ddbe45bedc09766323544c75d6825bdb8c62e3c",
            "5d206a9e8147c77248438214e185974a70f8214b30f353f12bc33192d24e1d93",
            "a3e80b4ab4f22d77f9d9348d3b668455e1e7a10684c816c951a1956b0f8e5473",
            "91c11cf709d7994441b02ada4dfda08c7bf37558da62bbe52e3db0a2744598f3",
            "3542e26499bfbd6f84fa973b3923a52ae61fee24b092bbadec76314ab282c12c"
        ],
        "globals": [
            "webpackChunkexchange",
            "clearImmediate",
            "setImmediate",
            "eventBus",
            "_PageAccelerator",
            "pageAccelerator"
        ],
        "storage_keys": [
            "@@",
            "lang",
            "vuex",
            "categoryNum"
        ],
        "tls": {
            "san": [
                "bitfinex180.com",
                "bitfinex181.com",
                "bitfinex182.com",
                "bitfinex183.com",
                "bitfinex184.com",
                "bitfinex185.com",
                "bitfinex186.com",
                "bitfinex187.com",
                "bitfinex188.com",
                "bitfinex189.com"
            ],
            "cipher": "AES_256_GCM",
            "issuer": "YR2",
            "subject": "bitfinex185.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-09T11:51:41Z",
            "valid_from": "2026-09-10T11:51:42Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 238,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "strict-transport-security": "max-age=31536000"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:08Z",
        "uuid": "6cef2ea3-8090-4876-838e-ef4bcfdba4a7",
        "scanned_at": "2026-09-14T07:16:40Z",
        "final_url": "https://bitfinex184.com/wap/",
        "status": 200,
        "redirected": "same-domain",
        "history": [
            {
                "url": "https://bitfinex184.com/",
                "status": 302
            },
            {
                "url": "https://bitfinex184.com/wap/",
                "status": 200
            }
        ],
        "dom_hash": "336fff67d32977be972e92385bc2385cfe2a570125420568d94998ce8dbc8f0a",
        "doc_hash": "a36e7919c7d81d905e80febfdaeb4367f5466c895492f8cfcca96ac01474176d",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitfinex184.com",
                "type": "A",
                "value": "172.81.98.56"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.81.98.56",
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "created": "2026-09-09T12:48:51Z",
            "updated": "2026-09-09T12:49:04Z",
            "expires": "2027-09-09T12:48:51Z",
            "nameservers": [
                "a1.share-dns.com",
                "b1.share-dns.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:47:13Z",
        "analysis_at": "2026-09-12T00:12:44Z",
        "stats": {
            "timeout": 0,
            "harmless": 54,
            "malicious": 4,
            "suspicious": 0,
            "undetected": 34
        },
        "detections": {
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "PhishFort": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing, Newly Registered (alphaMountain.ai)"
        },
        "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
        "created": "2026-09-09T12:48:51Z",
        "expires": "2027-09-09T12:48:51Z",
        "updated": "2026-09-09T12:49:04Z",
        "first_seen": "2026-09-10T08:19:43Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "172.81.98.56"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            }
        ],
        "dns_at": "2026-09-12T00:13:02Z",
        "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "bitfinex180.com",
                "bitfinex181.com",
                "bitfinex182.com",
                "bitfinex183.com",
                "bitfinex184.com",
                "bitfinex185.com",
                "bitfinex186.com",
                "bitfinex187.com",
                "bitfinex188.com",
                "bitfinex189.com"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6eda5d75724a1795c25856a8c650a90f8",
            "sha256": "029089892575ced79820836eb2b1ba44863d11b160764f5c7065333494c401d7",
            "subject": "bitfinex185.com",
            "valid_to": "2026-12-09T11:51:41Z",
            "valid_from": "2026-09-10T11:51:42Z"
        },
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "registrar_iana_id": "49",
            "registrar_url": "https://internet.gmo/",
            "created": "2026-09-09T12:48:51Z",
            "updated": "2026-09-09T12:49:04Z",
            "expires": "2027-09-09T12:48:51Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a1.share-dns.com",
                "b1.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "expiration": "2027-09-08T15:00:00Z",
                "last changed": "2026-09-09T12:59:04Z",
                "registration": "2026-09-09T03:48:51Z",
                "registrar expiration": "2027-09-08T15:00:00Z",
                "last update of RDAP database": "2026-09-10T08:19:43Z"
            }
        }
    }
}
```