bitzpie[.]com

This domain is flagged as an elevated-risk phishing resource specifically designed to impersonate legitimate cryptocurrency wallet services. Analysis indicates the site operates under the guise of '比特派钱包-安全多链' (Bitzpie Wallet - Secure Multi-Chain), a title that closely resembles authentic wallet providers to deceive users into disclosing private keys, recovery phrases, or transferring digital assets to attacker-controlled addresses. The threat type is classified as generic phishing with a targeted focus on cryptocurrency theft, a tactic increasingly observed in campaigns exploiting the irreversible nature of blockchain transactions. Infrastructure analysis reveals multiple technical indicators corroborating malicious intent. The domain bitzpie.com was registered on March 14, 2025, through West263 International Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 156.238.225.106, which has been linked to prior phishing infrastructure. Detection metrics show 12 out of 95 security vendors on a prominent threat intelligence platform flagged the domain as malicious, while a separate trust scoring system assigned it a 0/100 rating. The domain appears on at least one security blocklist and was proactively blocked by specialized anti-phishing systems. Technological artifacts include the use of Nginx as a web server, jQuery for client-side scripting, HTTP Strict Transport Security (HSTS) for enforced encryption, and HTTP/3 for improved performance—features that collectively mimic legitimate services to evade casual detection. The SSL certificate is issued by Let's Encrypt, a common choice among threat actors due to its free and automated issuance process. Mitigation against this threat requires a multi-layered approach tailored to cryptocurrency phishing. Users who may have interacted with bitzpie.com should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet using a hardware device or air-gapped solution. Credential rotation is critical, particularly for recovery phrases and private keys, which should never be stored digitally or shared. Organizations and individuals are advised to implement domain reputation checks in security gateways, blocking newly registered domains (NRDs) with creation dates within the last 30 days, especially those using high-risk registrars. Network-level protections should include real-time DNS filtering to prevent resolution of known malicious IPs, such as 156.238.225.106, and monitoring for outbound connections to newly observed domains. Endpoint detection systems should be configured to alert on browser sessions accessing domains with low trust scores (e.g., 0/100) or those flagged by multiple security vendors. Given the offline status of the domain, users should remain vigilant for successor domains using similar naming conventions or infrastructure, as threat actors frequently rotate domains to evade detection.