# PhishDestroy domain threat record: bitfinex188.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bitfinex188.com/
Machine-readable companion: https://phishdestroy.io/domain/bitfinex188.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-12 04:40:09 UTC
- Last availability or vendor check: 2026-10-21 01:16:36 UTC
- Stored record updated: 2026-10-22 14:21:14 UTC
- VirusTotal detections in the stored snapshot: 11/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: 1inch

## Stored infrastructure

- Observed IP address: 172.81.98.56
- Registrar in stored WHOIS data: GMO Internet Group, Inc. d/b/a Onamae.com
- Registration date (registry RDAP, bitfinex188.com): 2026-09-09 12:48:50 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0ba87-c3c1-75bd-affb-7dfffcb70b79/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bitfinex188.com
- Certificate Transparency search: https://crt.sh/?q=%25.bitfinex188.com
- Web Archive lookup: https://web.archive.org/web/*/https://bitfinex188.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
bitfinex188.com is a phishing domain built to pass as Bitfinex, the cryptocurrency exchange. The number tacked onto the brand name is a common trick to make a lookalike address seem like a regional or promotional mirror. It targets Bitfinex users and traders who might follow a link from an ad, chat message or fake support contact. PhishDestroy first flagged it on 2026-09-12, and the site has been offline since 2026-09-25, with its DNS still inactive as of 2026-10-19.

How the scam works
Exchange impersonation pages copy the real login and account screens so visitors type in their email, password and one-time 2FA codes. The operators replay those details on the genuine platform to empty balances, or they keep victims on the fake site and ask for deposits or bogus withdrawal fees. When last reached, the server answered with a "403 Forbidden" page rather than a Bitfinex lookalike, while our classification remains Bitfinex impersonation.

Evidence
On 2026-09-23, 11 of 89 VirusTotal engines flagged the domain. Named vendors included alphaMountain.ai, BitDefender, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky and Netcraft. That is a modest share of engines, but it spans several unrelated vendors. Spamhaus lists the domain in its DBL under the phishing category, which affects mail and DNS filtering widely. It also appears in four AlienVault OTX threat pulses, showing that other researchers tracked it independently.

Infrastructure
The domain was registered on 2026-09-09 through Onamae.com (GMO Internet Group). PhishDestroy caught it just three days later, a short gap typical of throwaway phishing domains set up for a quick campaign. It was hosted in Japan on the JT TELECOM INTERNATIONAL PTE.LTD. network, behind a free Let's Encrypt certificate. The padlock in the browser therefore said nothing about whether the site was legitimate. The site went dark about two weeks after registration.

What to do
If you entered Bitfinex credentials on this site, sign in through the official app or a bookmarked address and change your password right away. Reset 2FA, revoke any API keys you did not create, and turn on withdrawal address whitelisting. If you sent a deposit or paid a "fee" to unlock funds, do not send anything more. Report the transfer to Bitfinex support and your local police, keeping transaction IDs and messages as evidence. Defenders should block the domain at DNS and mail gateways and search logs for any traffic to it from 2026-09-09 onward. They should also watch for new Bitfinex lookalikes that use numeric suffixes.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0ba87-c3c1-75bd-affb-7dfffcb70b79/
VirusTotal report: https://www.virustotal.com/gui/domain/bitfinex188.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bitfinex188.com
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:19:26 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0ba87-c3c1-75bd-affb-7dfffcb70b79.png
  Captured: 2026-09-12 04:40:09 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/b3cfd0c5-b071-46fb-b620-7a89e0ca364a.png
  Captured: 2026-09-20 00:00:52 UTC
  Source report: https://radar.cloudflare.com/scan/b3cfd0c5-b071-46fb-b620-7a89e0ca364a
  SHA-256: a7c9ee0ac20a670c2250dafe8a0192abea32aea6ca87657f43dadd7be532396e
- URLScan · 2026-09-19: https://screenshots.phishdestroy.io/us/01a0ba87-c033-7029-9c20-c1bcfc60da57.png
  Captured: 2026-09-19 16:37:39 UTC
  Source report: https://urlscan.io/result/01a0ba87-c033-7029-9c20-c1bcfc60da57/
  SHA-256: 388f2779835e26e5ff2c1d650df23a8c0afb1879421420717d728ee1661c667d
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c65d-73cb-77ae-9044-a48a8597ea1b.png
  Captured: 2026-09-21 23:46:54 UTC
  Source report: https://urlscan.io/result/01a0c65d-73cb-77ae-9044-a48a8597ea1b/
  SHA-256: 388f2779835e26e5ff2c1d650df23a8c0afb1879421420717d728ee1661c667d

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T22:26:26Z",
        "uuid": "01a0ba87-c3c1-75bd-affb-7dfffcb70b79",
        "scanned_at": "2026-09-19T16:37:42Z",
        "final_url": "https://bitfinex188.com/wap/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://bitfinex177.com/",
                "from": "https://bitfinex188.com/",
                "status": 302
            },
            {
                "to": "https://bitfinex188.com:25352/",
                "from": "https://bitfinex177.com/"
            },
            {
                "to": "https://bitfinex188.com/wap/",
                "from": "https://bitfinex188.com:25352/",
                "status": 302
            }
        ],
        "ip": "172.81.98.56",
        "domains": [
            "bitfinex177.com",
            "cdnjs.cloudflare.com",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "104.17.24.14",
            "2606:4700::6810:5049",
            "172.67.204.230",
            "172.81.98.56"
        ],
        "asns": [
            "13335",
            "137535"
        ],
        "countries": [
            "US",
            "JP"
        ],
        "doc_hash": "1e4b7c8150bff5f21bdb39e3879dab22b9d59d949780b752886c5e11af38d5d1",
        "script_hashes": [
            "ac17ebfd2f332f03125ede8bc97ef3f81d70f54150b66597e5f42c7eef57829f",
            "d84d20b32bf61cfec5f536639e52a6c21925bb7b08ed7485ad6aa71502b317bf",
            "1b7efeb048f7db7f21ea0cd7397d5e5bbbffa031915001a386b4e18f0866d6d9",
            "24be5cc05161f5c72faf5594ba55a0fe0a94e1ad61786f25208cc663bc82f7d1",
            "878daef856219c15d7ea4aee2db7806fb60178935bdb9296c98379096b996339",
            "6e8acf0ae4a999213d22dd787ddbe45bedc09766323544c75d6825bdb8c62e3c",
            "5d206a9e8147c77248438214e185974a70f8214b30f353f12bc33192d24e1d93",
            "a3e80b4ab4f22d77f9d9348d3b668455e1e7a10684c816c951a1956b0f8e5473",
            "91c11cf709d7994441b02ada4dfda08c7bf37558da62bbe52e3db0a2744598f3",
            "3542e26499bfbd6f84fa973b3923a52ae61fee24b092bbadec76314ab282c12c"
        ],
        "globals": [
            "webpackChunkexchange",
            "clearImmediate",
            "setImmediate",
            "eventBus",
            "_PageAccelerator",
            "pageAccelerator"
        ],
        "cookies": [
            "server_session_0eb1b4d8"
        ],
        "storage_keys": [
            "@@",
            "lang",
            "vuex",
            "categoryNum"
        ],
        "tls": {
            "san": [
                "*.bitfinex177.com",
                "bitfinex177.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "bitfinex177.com",
            "protocol": "QUIC",
            "valid_to": "2026-12-18T11:49:51Z",
            "valid_from": "2026-09-19T11:49:52Z"
        },
        "domain_age_days": 9,
        "apex_age_days": 9,
        "tls_age_days": 0,
        "tls_valid_days": 89,
        "requests": 239,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 100,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T22:33:08Z",
        "uuid": "b3cfd0c5-b071-46fb-b620-7a89e0ca364a",
        "scanned_at": "2026-09-20T00:00:52Z",
        "final_url": "https://bitfinex177.com/",
        "status": 200,
        "redirected": "off-domain",
        "history": [
            {
                "url": "http://bitfinex188.com/",
                "status": 307
            },
            {
                "url": "https://bitfinex188.com/",
                "status": 302
            },
            {
                "url": "https://bitfinex177.com/",
                "status": 200
            }
        ],
        "dom_hash": "e385b634ec2a34081d6136f9ea71b4f27a23282b22b5ad506b44b47ece1a52d4",
        "doc_hash": "1e4b7c8150bff5f21bdb39e3879dab22b9d59d949780b752886c5e11af38d5d1",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bitfinex177.com",
                "type": "A",
                "value": "172.67.204.230"
            },
            {
                "name": "bitfinex177.com",
                "type": "A",
                "value": "104.21.69.52"
            },
            {
                "name": "bitfinex177.com",
                "type": "AAAA",
                "value": "2606:4700:3037::6815:4534"
            },
            {
                "name": "bitfinex177.com",
                "type": "AAAA",
                "value": "2606:4700:3033::ac43:cce6"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.204.230",
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "created": "2026-09-19T12:41:52Z",
            "updated": "2026-09-19T12:43:35Z",
            "expires": "2027-09-19T12:41:52Z",
            "nameservers": [
                "candy.ns.cloudflare.com",
                "lars.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T04:47:16Z",
        "analysis_at": "2026-10-07T18:34:32Z",
        "stats": {
            "timeout": 0,
            "harmless": 49,
            "malicious": 10,
            "suspicious": 0,
            "undetected": 33
        },
        "detections": {
            "G-Data": "phishing",
            "Sophos": "malware",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "SOCRadar": "phishing",
            "Kaspersky": "phishing",
            "PhishFort": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
        "created": "2026-09-09T12:48:50Z",
        "expires": "2027-09-09T12:48:50Z",
        "updated": "2026-09-09T12:49:08Z",
        "first_seen": "2026-09-10T08:22:15Z",
        "dns": [
            {
                "ttl": 600,
                "type": "A",
                "value": "172.81.98.56"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "a.share-dns.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "b.share-dns.net"
            },
            {
                "ttl": 600,
                "type": "SOA",
                "rname": "master.share-dns.com",
                "value": "a.share-dns.com"
            }
        ],
        "dns_at": "2026-09-23T09:45:29Z",
        "jarm": "40d40d40d00040d00042d42d000000e1ea2a807a629b496b664cf07ad7c08d",
        "cert": {
            "san": [
                "bitfinex137.com",
                "bitfinex167.com",
                "bitfinex180.com",
                "bitfinex188.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "6d7671060e60cdcf03a75f8c191b55ea5f8",
            "sha256": "8b1127919fd09b061732dc3cf2c1d544c009ebcea2026539ab5f275a56508171",
            "subject": "bitfinex180.com",
            "valid_to": "2026-12-18T15:43:12Z",
            "valid_from": "2026-09-19T15:43:13Z"
        },
        "whois": {
            "registrar": "GMO Internet Group, Inc. d/b/a Onamae.com",
            "registrar_iana_id": "49",
            "registrar_url": "https://internet.gmo/",
            "created": "2026-09-09T12:48:50Z",
            "updated": "2026-09-09T12:49:08Z",
            "expires": "2027-09-09T12:48:50Z",
            "status": [
                "clientTransferProhibited"
            ],
            "nameservers": [
                "a9.share-dns.com",
                "b9.share-dns.net"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited",
                "client update prohibited"
            ],
            "events": {
                "expiration": "2027-09-08T15:00:00Z",
                "last changed": "2026-09-09T12:59:04Z",
                "registration": "2026-09-09T03:48:50Z",
                "registrar expiration": "2027-09-08T15:00:00Z",
                "last update of RDAP database": "2026-10-07T19:21:18Z"
            }
        }
    }
}
```