bito[.]xin

Analysis of bito.xin, created on 2026-01-04 and hosted behind Cloudflare (AS13335) in the United States, shows a pattern consistent with an investment-scam operation. The domain resolves to 172.67.170.185 and uses Cloudflare’s DNS service (crystal.ns.cloudflare.com, leo.ns.cloudflare.com). The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS connection despite the malicious intent. HTTP requests return a 403 status code, suggesting the site is currently inaccessible, which aligns with the reported offline status. The page title returned by the server, “Bozei: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil”, explicitly advertises a broad financial‑services offering and matches the classified scam type of an investment scam.

The front-end stack includes Vue.js, HSTS, Cloudflare Browser Insights, and HTTP/3, all typical of modern web applications but not indicative of benign purpose. Reputation data is uniformly negative. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three known security blocklists. It is also listed by PhishDestroy, MetaMask, and SEAL as a blocked resource. AlienVault OTX references the domain in one threat‑intel pulse, and VirusTotal records a single positive detection out of 91 scanning engines, confirming that at least one vendor flagged the site as malicious.

The registrar, Gname.com Pte. Ltd., is a known bulk‑registration service often used by threat actors. Defenders should continue to block bito.xin at network perimeter and DNS layers, monitor for any re‑activation attempts, and add the associated IP address 172.67.170.185 to deny-list rules. Because the site is currently offline, threat actors may attempt to resurrect the domain or use similar naming conventions; therefore, security tools should be tuned to detect the combination of the page title keywords and the Cloudflare hosting profile.