bitxlucky[.]com

Analysis of bitxlucky.com shows a domain created on September 03, 2024 and registered through Tucows Domains Inc. The site resolves to the IP address 172.67.133.231, which is part of the Cloudflare network (AS13335) and located in the United States. Nameservers are georgia.ns.cloudflare.com and kaiser.ns.cloudflare.com, indicating that the domain relies on Cloudflare's DNS and edge services for delivery.

Infrastructure inspection reveals that the site serves HTTP status code 307, redirects clients, and presents a valid SSL certificate issued by Google Trust Services under the WE1 classification. Detected technologies include Node.js, Envoy, React, Next.js, HSTS, Cloudflare, Webpack, and HTTP/3, suggesting a modern web stack hosted behind a CDN. The presence of HSTS and HTTP/3 demonstrates an attempt to enforce secure transport, albeit within a malicious context.

Threat intelligence flags the page title "BITXLUCKY: Login Page" and classifies the activity as credential phishing. Reputation metrics are extremely low, with a Scamadviser trust score of 1/100 and a Gridinsoft trust score of 0/100. VirusTotal reports a single detection out of 95 security vendors, and the domain appears on the PhishDestroy blocklist. These indicators, combined with the high‑risk rating, confirm that the domain is actively used to harvest user credentials.

Defenders should prioritize immediate containment by adding bitxlucky.com to network and endpoint blocklists, and monitor DNS queries for the associated Cloudflare IP range. Continuous observation of traffic to the identified IP and inspection of TLS handshakes can help detect any pivot attempts. Given the modern stack, threat‑hunting rules that flag redirects (307) to unknown login pages and anomalous usage of Cloudflare‑served certificates are recommended to reduce exposure to this credential phishing campaign.