bit-dex[.]net

This domain, bit-dex.net, is identified as a crypto phishing drainer site designed to impersonate legitimate cryptocurrency exchange platforms. Analysis indicates the infrastructure was engineered to harvest user credentials and execute unauthorized transactions, likely targeting wallet private keys or seed phrases. No direct brand affiliation was confirmed, though the site mimics common exchange interfaces to deceive victims. The presence of technologies such as Smartsupp (live chat) and OWL Carousel (dynamic content) suggests an attempt to appear legitimate while facilitating fraudulent interactions. No specific drainer kit was conclusively identified, but the technical stack aligns with known phishing toolkits used in crypto theft operations. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on April 25, 2025, through Dynadot LLC, a registrar frequently associated with malicious domains. It resolves to the IP address 86.107.77.165, which has been linked to prior phishing campaigns. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft and Scamadviser assign trust scores of 0/100 and 1/100, respectively. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Google Safe Browsing (GSB) status was not explicitly provided, but the combination of low trust scores and blocklist presence confirms elevated risk. Technologies detected include PHP, LiteSpeed, and Bootstrap, which are commonly exploited in phishing sites for dynamic content delivery and obfuscation. As of the latest assessment, bit-dex.net has been taken offline, likely due to enforcement actions or hosting provider intervention. However, the residual risk remains elevated due to the domain's recent creation and association with known malicious infrastructure. Users who interacted with the site should immediately revoke any connected wallet permissions, transfer assets to a new wallet, and monitor for unauthorized transactions. Organizations are advised to update blocklists with the domain and IP address, while security teams should investigate potential lateral movement within networks that accessed the site. The registrar and hosting provider should be notified to prevent re-activation under similar names or infrastructure.