bitget-login-en[.]pages[.]dev

The domain bitget-login-en.pages.dev was created on February 21, 2026 and registered through Cloudflare, Inc., using the authoritative nameservers walt.ns.cloudflare.com and rayne.ns.cloudflare.com. DNS resolution points to IP address 172.66.46.247, an address owned by AS13335 Cloudflare, Inc. located in the United States. The web service presents the page title "Suspected phishing site | Cloudflare" and returns an HTTP 403 status code, indicating that the server is intentionally denying access to the requested resource. TLS termination is performed with a certificate issued by Google Trust Services under the WE1 label, a common configuration for Cloudflare‑hosted sites. VirusTotal analysis recorded five detections out of ninety‑three scanned security vendors, confirming that multiple AV engines consider the domain malicious.

Independent reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The domain appears on one external security blocklist and has been actively blocked by the PhishDestroy mitigation service. Detected technologies include HSTS, Cloudflare’s edge network, and HTTP/3 support, all consistent with the observed hosting environment. The threat profile identifies the domain as an impersonation of the cryptocurrency exchange brand Bitget, categorized as a crypto‑related scam. No additional payload or content analysis is available beyond the page title, so the exact phishing mechanics remain unverified.

Current status shows the site has been taken offline, but historical activity suggests it was used to lure victims into providing Bitget credentials or cryptocurrency‑related information. Defenders should add bitget-login-en.pages.dev and its hosting IP 172.66.46.247 to network deny lists, monitor outbound traffic for connections to this address on ports 80 and 443, and incorporate the observed indicators into intrusion detection signatures.