A checkout page that looks exactly like Bitrefill's will let you pay up to $1,990 in Bitcoin, hand you a QR code and a one-time address, and start a countdown clock. Everything about it behaves the way the real thing does. The only difference that matters is where the money lands, and it is not with the retailer.
Researchers at Malwarebytes found a whole cluster of these pages rather than a single site. Bitrefill is a real company that sells gift cards for Amazon, Apple, Nintendo and thousands of other brands, and it genuinely accepts cryptocurrency. That last detail is what makes the copy work.
No password to steal, no chargeback
Most phishing has to survive a chain of steps: steal a password, get past two-factor authentication, log in without tripping a fraud check, then turn account access into money. Plenty of scams fall apart in the middle. This one skips the chain, because the victim sends the money themselves. Cryptocurrency payments generally cannot be reversed or charged back, so the transfer is the end of the story. On most retail sites a demand for crypto would be odd enough to give somebody pause. On a copy of Bitrefill's checkout it looks like business as usual.
Tuned like a real online shop
The page Malwarebytes examined asks for an email address for order updates and links to a terms of service and a privacy policy. It offers Bitcoin, Ethereum, USDC, USDT, Solana and Litecoin, plus card payments for a small surcharge. Amounts arrive as preset buttons topping out at $1,990. Inconsistent currency symbols are one of the few visible slips.
The detail that says most about the operation is not really on the page. The fake checkout has commercial analytics software installed, the same category of product a legitimate e-commerce team uses to measure how many shoppers abandon a cart. Somebody is watching the conversion rate and tuning it. This is a funnel, run as a business, with the victim cast as the customer.
The brand name is not the address
The domains lean on three tricks. Some swap a single letter for a lookalike character. Some bolt a plausible word such as pay or gift onto the brand. Several are internationalized domain names, which mix characters from other alphabets or accented Latin letters and which browsers store in an ASCII form beginning with xn-- known as Punycode. On screen they are almost impossible to separate from the real name, and on a phone it is worse.
Bitrefill has said publicly that copycat sites using similar names have been turning up in search results and that its security team is working with takedown specialists. It fits a pattern visible elsewhere this month, from a network of 118,000 fake shops to phishing aimed at hardware wallet owners. Copying a checkout is a product now, not a prank.
Start from the bookmark, not the search
Reach payment pages through a saved bookmark or by typing bitrefill.com yourself, and if you are already mid-purchase, stay in that session rather than opening a checkout from a separate search. Check the address bar before approving anything: a legitimate subdomain puts the extra word before the main domain, as in pay.example.com, while example-pay.com is a separate domain anyone can register. Do not approve wallet requests on a site you have not verified: signing a transaction or granting token permissions can move assets, even though connecting a wallet alone normally does not.
If money has already gone, report the destination address to your exchange or wallet provider, report it to your national fraud reporting service, and tell Bitrefill so the domain joins its takedown queue. Recovery is unlikely, and any service promising to retrieve stolen cryptocurrency for an upfront fee is usually the second scam.
Indicators
A defanged sample: bitrefill-payments[.]com, bitrefill-pays[.]com, pay-bitregill[.]com, bitrefall[.]com, butrefill[.]com, bitrgift[.]com, xn--bitrefll-71a[.]com, xn--bitreill-cz9c[.]com, xn--btrefill-l2a[.]com.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.