bitcointix[.]com

This domain, bitcointix.com, is identified as a brand impersonation phishing site targeting cryptocurrency users. Analysis indicates the site mimics legitimate Bitcoin exchange platforms, presenting a fraudulent interface for buying and selling Bitcoin and Ethereum. The page title, 'Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | BITCOINTIX,' directly aligns with the tactics used to deceive users into disclosing wallet credentials or transferring digital assets to attacker-controlled addresses. No specific drainer kit signatures have been confirmed, but the site's structure suggests credential harvesting and direct asset theft as primary objectives. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on March 30, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been linked to other phishing campaigns. Detection metrics include a VirusTotal score of 6/95, with six security vendors flagging the domain as malicious. The site appears on three security blocklists, and its Gridinsoft trust score is 0/100, further corroborating its fraudulent nature. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not mitigate the underlying threat. As of the latest assessment, bitcointix.com has been taken offline, likely in response to detection and reporting by security entities such as MetaMask, PhishDestroy, and SEAL. Despite its current inactive status, residual risk remains for users who may have interacted with the site prior to its removal. Organizations and individuals are advised to block the domain and associated IP address at the network level, monitor for unauthorized transactions, and educate users on recognizing cryptocurrency phishing attempts. Continuous vigilance is recommended, as threat actors may re-establish the campaign under similar domains or infrastructure.