bittester2[.]info

Analysis indicates that the domain bittester2.info is currently offline but was previously associated with a brand‑impersonation campaign targeting Binance. The site presented the page title “Bittester2 - Swap | Trade | P2P | Ico,” which aligns with typical cryptocurrency trading terminology and reinforces the impersonation narrative. Infrastructure analysis reveals that the domain resolves to the IP address 172.67.194.198, which is hosted within the Cloudflare network (AS13335) and geolocated to the United States. No SSL certificate was observed for the host, suggesting that the site operated without HTTPS encryption. The domain’s authoritative nameservers are roxy.ns.cloudflare.com and toby.ns.cloudflare.com, both belonging to Cloudflare’s DNS service.

Detection data shows that one of ninety‑five VirusTotal security vendors flagged the domain, indicating at least a single independent detection of malicious activity. The domain appears on a single external blocklist and is specifically listed by PhishDestroy as a malicious entry. Reputation services assign a Gridinsoft trust score of 0 out of 100 and a Scamadviser score of 25 out of 100, reflecting a very low level of trust. The brand target is explicitly identified as Binance, confirming the impersonation intent.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no detailed page content or malware analysis is available. The offline status limits real‑time observation of HTTP responses or potential redirects. Defenders should therefore treat the domain as hostile: ingest the IP address 172.67.194.198 and the domain name into network and endpoint blocklists, monitor for any resurgence of the domain or similar sub‑domains, and enforce strict outbound filtering for traffic to Cloudflare‑hosted IPs that lack valid TLS certificates.