bito[.]icu

Analysis of the domain bito.icu indicates it was actively used as part of an investment scam phishing operation. The domain was registered on January 4, 2026, through Gname.com Pte. Ltd. and is currently offline. Infrastructure analysis reveals Cloudflare-hosted nameservers (crystal.ns.cloudflare.com, leo.ns.cloudflare.com) and resolution to IP 172.67.165.147 (AS13335, Cloudflare, Inc., US). The SSL certificate is issued by Google Trust Services (WE1), a common configuration for phishing sites leveraging Cloudflare's proxy services. The page title, 'Bozei: One-Stop Global Investment Platform | Forex | Commodities | Stocks | Indices | Cryptocurrencies | Gold | Oil,' explicitly describes a fraudulent investment platform targeting financial markets, including forex, commodities, and cryptocurrencies.

This aligns with the classified scam type (investment scam) and suggests an attempt to deceive victims into depositing funds under false pretenses. Detection and blocking data further corroborate malicious intent. The domain appears on three security blocklists and is flagged by PhishDestroy, MetaMask, and SEAL. AlienVault OTX records it in one threat intelligence pulse, indicating prior identification by the security community.

Gridinsoft assigns a trust score of 0/100, reflecting high confidence in its malicious classification. While VirusTotal shows three security vendors flagging the domain, the absence of broader detection does not diminish the confirmed evidence from blocklists, SSL infrastructure, and scam classification. Defenders should treat this domain as part of a confirmed phishing campaign and maintain blocking rules, particularly for financial and cryptocurrency-related threats. Further monitoring of associated infrastructure (e.g., Cloudflare IP ranges, Gname.com registrations) may reveal additional linked domains.