bittrex[.]io

Analysis on July 24, 2026 identifies bittrex.io as an active generic phishing infrastructure. The site returned the page title “Buy” before being taken offline. DNS resolution points to 172.67.223.116, an IP owned by Cloudflare (AS13335) located in the United States. The domain was registered on March 03, 2026 through NiceNIC International Group Co., Limited and uses Cloudflare nameservers darwin.ns.cloudflare.com and harleigh.ns.cloudflare.com.

The SSL certificate is issued by Google Trust Services under the WE1 root, indicating a valid TLS handshake. Automated scanning on VirusTotal recorded 11 detections out of 94 security vendors, and the domain appears on a single blocklist, currently PhishDestroy. The hosting environment exposed several front‑end libraries, including Chart.js, jsDelivr, Facebook Pixel, cdnjs, Cloudflare Browser Insights and HTTP/3 support, which are typical of low‑cost phishing kits. A Gridinsoft trust score of 1/100 further reflects a high confidence of malicious intent.

The exact payload or credential collection mechanism has not been publicly disclosed, and only the page title is known; therefore the specific phishing workflow remains uncertain. Defensive recommendations include adding bittrex.io to URL filtering, DNS sinkholing, and updating intrusion detection signatures to flag connections to 172.67.223.116 via Cloudflare. Organizations should also monitor for duplicate domains using the same registrar or similar naming patterns, and enforce multi‑factor authentication for accounts that could be targeted by credential harvesting attempts.