bitbank[.]click

The domain bitbank.click was registered on May 18, 2026 through Gname.com Pte. Ltd. and is presently classified as a high‑risk banking phishing site. It returns an HTTP 302 redirect and displays the page title "Google Public DNS," a technique frequently employed to disguise malicious pages and evade casual inspection.

Infrastructure analysis reveals that bitbank.click resolves to the IP address 188.114.96.3, which is hosted by CloudFlare, Inc. in Canada. The authoritative name servers are anita.ns.cloudflare.com and olof.ns.cloudflare.com, both owned by the same provider. The site presents a TLS certificate issued by Let’s Encrypt (identifier E8), a free certificate authority commonly leveraged by rapid‑deployment phishing campaigns to obtain encrypted connections without incurring cost.

Threat intelligence indicates that one of ninety‑five VirusTotal scanners flagged the domain, and AlienVault OTX lists it in a single threat pulse. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on three public blocklists. It is already blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple defensive platforms have taken action against it. The low trust score and the presence on blocklists underscore the malicious nature of the infrastructure despite the minimal detection ratio on VirusTotal.

Defenders should continue to block bitbank.click at both DNS and network perimeter layers, monitor outbound connections to 188.114.96.3, and enforce strict email filtering for messages claiming to originate from banking institutions. Additional analysis is advised to capture the final landing page after the 302 redirect, as it is likely a credential‑harvesting portal targeting banking customers. Continuous monitoring for newly observed indicators associated with this domain will help mitigate potential credential theft and reduce exposure to the broader phishing campaign.