trade[.]whitebit-m[.]com

Analysis indicates that trade.whitebit-m.com is an active credential-phishing domain targeting cryptocurrency users. The domain was registered on February 21, 2026, through Dynadot LLC and currently resolves to IP 198.251.83.50 (AS53667 FranTech Solutions, US). Nameservers are ns103.my-control-panel.com and ns104.my-control-panel.com. The site returns an HTTP 500 error with a database access denial message: 'SQLSTATE[28000] [1045] Access denied for user stanweb001_whitebit@localhost (using password: YES) (SQL: select * from general_settings limit 1)', suggesting a misconfigured or exposed backend. Technologies detected include LiteSpeed and HTTP/3. The SSL certificate is issued by Let's Encrypt (serial E8). As of July 12, 2026, the domain appears on one security blocklist, and two of 93 security vendors on VirusTotal flag it as malicious. The scam type is classified as credential phishing, though the exact content of the phishing page is not yet confirmed due to the current server error. Defenders should treat this domain as high-risk and consider blocking it at the DNS or proxy level. Further investigation may reveal additional infrastructure or campaign linkages, particularly given the use of a cryptocurrency-related username in the database error.