bitfinexx[.]cc

PhishDestroy identifies bitfinexx.cc as an active, under-investigation domain that is currently masquerading as the legitimate Bitfinex cryptocurrency exchange to harvest credentials and drain wallets. The campaign is classified as a generic phishing operation leveraging brand impersonation for maximum impact.

This domain was flagged with a risk rating of under_investigation by internal systems on 6da3f7 seed analysis. VirusTotal shows the sample remains undetected by 2 of 95 engines as of time of writing. The domain is registered via Gname.com Pte. Ltd., a registrar frequently abused in low-cost bulk registrations, and resolved to IP address 107.149.103.148 at the time of discovery. The domain itself was created on October 18, 2025, less than 24 hours prior to detection, and currently holds a Let’s Encrypt SSL certificate, which signals an attempt to appear legitimate. Despite its freshness, it has not yet appeared on public blocklists or threat intelligence feeds, and public reputation scores remain neutral or absent. This combination of unaged domain, unflagged file, and use of free SSL indicates an opportunistic, rapidly evolving threat leveraging low barrier-to-entry infrastructure.

Organizations and users should immediately block inbound DNS resolutions and outbound HTTP(S) connections to bitfinexx.cc at the network perimeter and endpoint levels. Given the threat type—brand impersonation phishing targeting cryptocurrency exchange accounts—security teams should prioritize alerting on any beaconing to the associated IP, scanning for user reports of wallet drain attempts, and updating browser blocklists with the domain. End users should be warned via internal channels to verify any exchange-related links via official channels and to avoid entering credentials or wallet seeds on sites accessed through unsolicited links. This domain will remain under active monitoring by PhishDestroy; signatures and hashes are available via internal feeds under seed 6da3f7 for SOC integration.