bitforex168[.]net

Analysis of bitforex168.net indicates a high-risk phishing domain targeting cryptocurrency exchange users. The domain was registered on November 18, 2025, through GoDaddy.com, LLC, and remains active as of July 28, 2026. Infrastructure analysis reveals resolution to IP address 154.23.252.104, with nameservers ns03.domaincontrol.com and ns04.domaincontrol.com, a common configuration for domains registered via GoDaddy. Google Safe Browsing classifies the domain under 'social engineering,' a designation typically applied to sites designed to deceive users into divulging credentials or sensitive information.

Detection data from VirusTotal shows 15 of 91 security vendors flagging the domain as malicious, a significant indicator of phishing activity. The domain also appears on one security blocklist, further corroborating its classification as a threat. The domain's name, 'bitforex168,' suggests an attempt to impersonate a cryptocurrency exchange platform, though the exact content and functionality of the site have not been analyzed. No evidence of a specific phishing kit or brand target beyond the domain name itself is currently available.

Defenders are advised to block the domain at the DNS or network level, particularly in environments where cryptocurrency-related activity occurs. Monitoring for connections to the associated IP address (154.23.252.104) may help identify compromised systems or users who have interacted with the phishing site. Given the domain's registration age and continued activity, it is likely part of an ongoing campaign. Further investigation into the hosting provider and IP reputation is recommended to assess potential links to other malicious infrastructure.