# PhishDestroy threat dossier — bitipei.com.cn ================================================================ Fetched: 2026-07-26 18:17:59 UTC Canonical: https://phishdestroy.io/domain/bitipei.com.cn/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Credential Phishing ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 19/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CRDF, CyRadar, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Kaspersky, Lionic, Netcraft, SOCRadar, Sophos, VIPRE, Webroot URLQuery: 2 detections AlienVault OTX: 2 pulses (threat-intel feed mentions) Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 154.206.128.230 (HK, Hong Kong) ASN: AS139880 OWGELS INTERNATIONAL CO., LIMITED Hosting org: Starbow Ltd Registrar: Dynadot Inc Registered: 2026-04-27 Page title: 比特派(Bitpie)全球领先多链钱包｜比特派钱包官网下载｜Bitpie Wallet HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / R13 Expires: 2026-07-28 Status: INVALID chain Fingerprint: b4a674fe06e2f8e97ba3ef5284594cc4c89bdbf160f04adfc14ca4423df8a335 Subject Alternative Names (related infrastructure — often same operator): - bitapei.com.cn - bitbpei.com.cn - bitcpei.com.cn - bitdpei.com.cn - bithpei.com.cn - bitipai.com.cn - bitjpei.com.cn - bitlpei.com.cn - bitmpei.com.cn - bitnpai.com.cn - bitnpei.com.cn - bitopei.com.cn - bitppei.com.cn - bitqpei.com.cn - bitrpei.com.cn ... +38 more ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-27 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-09 17:25:00 UTC (by PhishDestroy tracker) First reported: 2026-06-09 15:26:31 UTC (abuse notice filed) Last verified: 2026-07-26 16:20:41 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019eacfb-c88a-7408-a4d6-4b70e03e6c40/ URLQuery: https://urlquery.net/report/a9fcc8ef-cea7-4c48-b6c8-5ee9540c6096 Wayback Machine: https://web.archive.org/web/*/bitipei.com.cn crt.sh CT logs: https://crt.sh/?q=%25.bitipei.com.cn Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=bitipei.com.cn AlienVault OTX: https://otx.alienvault.com/indicator/domain/bitipei.com.cn URLhaus: https://urlhaus.abuse.ch/host/bitipei.com.cn/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-25 22:01:13 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] bitipei.com.cn: Fake Bitpie Wallet Crypto Credential Theft Site This domain, bitipei.com.cn, is identified as a high-risk credential theft operation targeting cryptocurrency users through brand impersonation. Analysis indicates the site mimics the legitimate Bitpie Wallet, a multi-chain cryptocurrency wallet, by replicating its branding, page title (比特派(Bitpie)全球领先多链钱包｜比特派钱包官网下载｜Bitpie Wallet), and user interface. The threat actor likely deployed a credential-harvesting kit designed to capture wallet recovery phrases, private keys, or login credentials under the guise of a wallet download portal. No direct evidence of a crypto drainer script was observed, but the infrastructure aligns with known credential theft campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, with detection engines classifying it as malicious or phishing. It was registered through Dynadot Inc, a registrar frequently abused for fraudulent domains, and resolves to the IP address 154.206.128.230, a host with a history of association with phishing and malware distribution. The SSL certificate is issued by Let's Encrypt (R13), a common choice for threat actors due to its low-cost and automated issuance process. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and was taken offline following detection. No creation date was provided in the available intelligence, but the use of Let's Encrypt R13 suggests recent activity, as this intermediate certificate is relatively new. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist, including potential re-registration under a similar domain or reuse of the same IP address for other malicious activities. Users who interacted with the site prior to takedown should assume credential exposure and take immediate action: revoke access to any connected wallets, generate new recovery phrases, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and IP address, and security teams should investigate any historical DNS resolutions or network connections to 154.206.128.230. Given the high-risk nature of credential theft targeting cryptocurrency users, affected individuals should also enable multi-factor authentication (MFA) on all related accounts and verify the legitimacy of any software downloaded from the impersonated brand. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260609-BC8E0D TLS cert SHA-256: b4a674fe06e2f8e97ba3ef5284594cc4c89bdbf160f04adfc14ca4423df8a335 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/bitipei.com.cn/ JSON API: https://api.destroy.tools/v1/check?domain=bitipei.com.cn Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 199,003 domains (68,328 alive under monitoring, 129,126 confirmed takedowns/dead). Site: https://phishdestroy.io