bitnextese-test[.]best

This domain, bitnextese-test.best, is identified as an active credential theft phishing site targeting users in the cryptocurrency sector. Analysis indicates the infrastructure is designed to mimic legitimate exchange or wallet services, likely to harvest login credentials, API keys, or recovery phrases. The absence of a fully deployed frontend (displaying only a 'Coming Soon' page title) suggests the campaign may still be in a preparatory or testing phase, or could be leveraging cloaking techniques to evade detection during initial scans. Infrastructure analysis reveals the domain was registered on July 24, 2025, through the registrar NETIM, a provider frequently observed in phishing operations due to its permissive registration policies. The domain resolves to the IP address 45.9.148.131, an address previously associated with other malicious campaigns, including crypto drainers and fake login portals. Detection metrics show the domain is flagged by 4 out of 95 security vendors on VirusTotal, while it appears on one security blocklist, specifically PhishDestroy. Notably, the domain is not currently listed in Google Safe Browsing, which may allow it to evade some browser-based protections. The current status of bitnextese-test.best remains active, with no evidence of takedown or sinkholing. The elevated risk level is attributed to the domain's recent registration, association with known malicious infrastructure, and its targeting of high-value credentials in the cryptocurrency space. Users and organizations are advised to block the domain and IP at the network level, while security teams should monitor for related domains registered through the same registrar or resolving to the same IP. Given the domain's low detection rate, reliance on traditional blocklists may be insufficient; proactive hunting for related indicators of compromise is recommended.