bitstamp[.]one

The domain bitstamp.one is identified as a cryptocurrency phishing site designed to impersonate the legitimate exchange Bitstamp. Analysis indicates this infrastructure was actively used to harvest wallet credentials and facilitate unauthorized fund transfers. As of the latest verification, the domain has been taken offline, though residual risk remains for users who may have interacted with it prior to deactivation. Infrastructure analysis reveals the domain was registered on March 23, 2026, through Gname.com Pte. Ltd., an uncommon registrar for legitimate financial services. It resolved to the IP address 172.67.203.2, hosted behind Cloudflare infrastructure in Canada, which is frequently leveraged by threat actors to obscure origin servers. The domain was flagged by 10 of 95 security vendors on VirusTotal, with detections from multiple anti-phishing and blockchain security engines. It appeared on three independent security blocklists, including PhishDestroy, MetaMask’s threat intelligence feed, and the SEAL anti-fraud consortium. The SSL certificate was issued by Let’s Encrypt (serial E8), a common but non-indicative certificate authority used across both legitimate and malicious sites. The page title, 'Tufejix,' does not correspond to any known Bitstamp branding or service, further suggesting fraudulent intent. The domain’s current status is offline, though historical interactions may still pose risks to users who entered sensitive information. Organizations and individuals are advised to block the domain and associated IP at the network level, revoke any credentials or wallet access shared with the site, and monitor connected accounts for unauthorized transactions. Users who suspect exposure should immediately transfer assets to new, secure wallets and report the incident to relevant financial and cybersecurity authorities. Proactive review of browser history and installed extensions is recommended to identify potential residual compromise.