bitwexv3gpt[.]live

The domain bitwexv3gpt.live is identified as a cryptocurrency credential theft operation impersonating the Bitwex trading platform. Analysis indicates the site presents itself as an official platform for AI-assisted trading, specifically using the branding 'Bitwex +v3 GPT,' to deceive users into disclosing sensitive login credentials or wallet information. As of the latest assessment, the domain has been taken offline, though its infrastructure remains a documented threat. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 27, 2026, an anomalous future date suggesting potential obfuscation or misconfiguration. It resolved to the IP address 172.67.177.172, a Cloudflare-associated endpoint, and employed technologies including Unpkg, jsDelivr, jQuery, and Cloudflare Browser Insights. The site’s SSL certificate was issued by Let’s Encrypt, a common feature in both legitimate and malicious domains. Detection metrics show the domain was flagged by 6 of 95 security vendors on VirusTotal, while independent blocklists such as PhishDestroy and OISD have also listed it. The Gridinsoft trust score for this domain is 0 out of 100, further confirming its malicious classification. Given the domain’s current offline status, immediate interaction risks are mitigated; however, the infrastructure and registration details remain indicative of a broader phishing campaign. Users and organizations are advised to block the domain and associated IP address 172.67.177.172 at the network level. Security teams should monitor for re-registration under similar naming conventions or slight variations. Individuals who may have interacted with the site should revoke any active sessions, rotate credentials, and audit connected cryptocurrency wallets for unauthorized transactions. Proactive detection rules should be updated to include this domain and its technical indicators in threat intelligence feeds.