bitbdiuigegienn.gitbook.io was a phishing page hosted on GitBook's documentation platform. It impersonated Bitbuy, a Canadian crypto exchange, under the title "Bitbuy Login: Unlocking Your Access to the Crypto Universe | us", and targeted Bitbuy account holders. PhishDestroy first flagged it on 2026-09-11. The site has been offline since 2026-09-14 and the provider has blocked its content, which was still the case on 2026-10-19.
How the scam works
The page presents itself as a Bitbuy sign-in portal. The random-looking subdomain sits on a legitimate documentation host, which helps it look less suspicious in search results and shared links. Visitors who type their email, password or one-time codes hand them to the operators. The operators can then log into the real exchange account, drain balances and change security settings before the owner notices.
Evidence
Fourteen of 89 VirusTotal engines flagged the page as of 2026-09-13. They include crypto-focused ChainPatrol alongside BitDefender, ESET, Kaspersky, Fortinet, Emsisoft, G-Data and alphaMountain.ai. Detection by a crypto specialist and several major antivirus vendors makes the verdict hard to dismiss as a single false positive. Besides PhishDestroy, the page is listed on the MetaMask and SEAL blocklists.
Infrastructure
The page lived on a gitbook.io subdomain, and GitBook is the registrar of record. The 2014-03-30 registration date belongs to the parent platform, not the scammer, so it says nothing about how long this operation ran. Traffic was served through Cloudflare's network with a Canadian location, matching Bitbuy's home market. The operators built nothing of their own and relied entirely on free, reputable hosting. That kind of setup is quick to create and quick to abandon, and the page went dark three days after PhishDestroy detected it.
What to do
If you entered Bitbuy credentials on this page, change your Bitbuy password at once from the official app or a typed-in address. Do the same anywhere else you reuse that password. Reset two-factor authentication, sign out of all active sessions, and check your recent logins, withdrawals and saved withdrawal addresses. If you see anything you don't recognize, contact Bitbuy support immediately. Defenders should block the full hostname and watch for similar Bitbuy-themed subdomains on documentation and site-builder platforms.
DOM Analysisanalyzed 2026年9月11日score 80/1001 brand signal
Submitted URLhttp://bitbdiuigegienn.gitbook.io/
Favicon Hash
Observed page title
Bitbuy Login: Unlocking Your Access to the Crypto Universe | us
Automated brand references
Ethereum
TLS証明書
発行者 Google Trust Services / WE1
Network & certificates
Stored technical evidence
Network & DNS
Shared CDN edge
Resolved IP
172.64.147.209
Network ASN
AS13335
Organization
Cloudflare, Inc.
Observed location
Toronto, CA
Server header
cloudflare
Edge-IP の評判はこのドメインに起因しません。
ネームサーバー 1
hugh.ns.cloudflare.com
Location describes the IP network.
TLS証明書
Issuer
Google Trust Services / WE1
Valid from
2026-07-17 18:03:25
Valid until
2026-10-15 19:03:12
Hostname coverage
Certificate hostname mismatch
Validity
Stored certificate expired
Collection time
2026-09-11 10:02:05 UTC
Collection source
PhishDestroy collector
Certificate fingerprintd76aa1094c3d1ca19014ac824313b04e833289dec61fbca06aa6f92bad9464adCertificate names · 1 SANs
gitbook.io
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
