bitipei[.]com[.]cn

This domain, bitipei.com.cn, is identified as a high-risk credential theft operation targeting cryptocurrency users through brand impersonation. Analysis indicates the site mimics the legitimate Bitpie Wallet, a multi-chain cryptocurrency wallet, by replicating its branding, page title (比特派(Bitpie)全球领先多链钱包｜比特派钱包官网下载｜Bitpie Wallet), and user interface. The threat actor likely deployed a credential-harvesting kit designed to capture wallet recovery phrases, private keys, or login credentials under the guise of a wallet download portal. No direct evidence of a crypto drainer script was observed, but the infrastructure aligns with known credential theft campaigns targeting decentralized finance (DeFi) users. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 19 out of 95 security vendors on VirusTotal, with detection engines classifying it as malicious or phishing. It was registered through Dynadot Inc, a registrar frequently abused for fraudulent domains, and resolves to the IP address 154.206.128.230, a host with a history of association with phishing and malware distribution. The SSL certificate is issued by Let's Encrypt (R13), a common choice for threat actors due to its low-cost and automated issuance process. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and was taken offline following detection. No creation date was provided in the available intelligence, but the use of Let's Encrypt R13 suggests recent activity, as this intermediate certificate is relatively new. The domain is currently offline, reducing immediate risk to end users. However, residual threats persist, including potential re-registration under a similar domain or reuse of the same IP address for other malicious activities. Users who interacted with the site prior to takedown should assume credential exposure and take immediate action: revoke access to any connected wallets, generate new recovery phrases, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and IP address, and security teams should investigate any historical DNS resolutions or network connections to 154.206.128.230. Given the high-risk nature of credential theft targeting cryptocurrency users, affected individuals should also enable multi-factor authentication (MFA) on all related accounts and verify the legitimacy of any software downloaded from the impersonated brand.