bitiniprohex[.]com

PhishDestroy identifies bitiniprohex.com as an active Bitcoin drainer domain designed to deceive users into transferring cryptocurrency to attacker-controlled wallets. This domain mimics legitimate services by hosting fraudulent landing pages that prompt victims to connect their wallets or enter payment details, triggering unauthorized transactions. The infrastructure is consistent with known drainer kits that manipulate clipboard activity or spoof wallet interfaces to siphon funds under false pretenses. This domain was flagged by 10 out of 95 VirusTotal security vendors, indicating widespread suspicion of malicious activity. It resolves to IP address 198.251.81.14 and was registered through Global Domain Group LLC on March 14, 2025. While Google Safe Browsing (GSB) status and blocklist participation remain unverified beyond the VirusTotal consensus, the combination of recent creation, offshore registrar, and high detection rate elevates its threat profile. Technical attribution suggests opportunistic deployment rather than a persistent long-term campaign, but the absence of HTTPS-only enforcement (despite using a Let’s Encrypt certificate) further exposes users to man-in-the-middle interception risks. As of the most recent scan, bitiniprohex.com remains active and unblocked by default protections. Immediate user actions include blocking the domain at DNS/network level, refraining from wallet connections, and reporting to security vendors or cryptocurrency platforms. While short-term exposure is elevated due to low blocklist saturation, long-term risk decreases as detection signatures propagate. Users should treat this domain as hostile and avoid all associated URLs or IP ranges until comprehensive remediation occurs.