bitfinex[.]935257177[.]xyz

Analysis of the domain bitfinex.935257177.xyz, observed on July 23, 2026, reveals a high‑risk phishing infrastructure that is actively serving malicious content. The domain was created on April 14, 2024 and registered through Spaceship, Inc., indicating a relatively recent registration that aligns with typical phishing campaigns. DNS resolution points to the IP address 140.238.41.192, and the authoritative name servers are dora.ns.cloudflare.com and nitin.ns.cloudflare.com, both operated by Cloudflare, a pattern often used to hide the true hosting location and to benefit from Cloudflare’s built‑in DDoS protection. The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one reputable anti‑phishing service has taken action against it.

VirusTotal reports three detections out of ninety‑one scanned vendors, providing additional corroboration that security products have identified malicious behavior associated with this host. The current operational status is listed as active, meaning the domain continues to resolve and can be reached by victims. No public page title, SSL certificate details, Safe Browsing verdict, or Open Threat Exchange (OTX) references are available in the supplied intelligence, leaving the exact content of the landing page and the specific credential‑stealing mechanism unverified.

Defenders should therefore treat the domain as hostile, enforce block‑list rules at perimeter firewalls and DNS resolvers, and consider sinkholing the IP address 140.238.41.192 to disrupt traffic. Continuous monitoring of Cloudflare name‑server changes is advised, as the attacker may switch infrastructure to evade detection. Given the limited but consistent indicators—registration data, IP address, blocklist presence, and multi‑vendor detections—organizations are recommended to add bitfinex.935257177.