bitgetz[.]biz

The domain bitgetz.biz is flagged as an active brand‑impersonation infrastructure targeting users of the Bitget cryptocurrency platform. DNS resolution points to IP 185.18.222.225, which is associated with ASN AS396356 in Japan. The host serves a TLS certificate issued by Let’s Encrypt (E7) and redirects HTTP requests with a 302 status code. Page metadata reports a title of “Web3 Wallet Login”, indicating a cryptocurrency‑related credential‑harvesting attempt. The site was registered on 21 February 2026 through the registrar Spaceship, Inc., and is hosted behind Cloudflare name servers ryan.ns.cloudflare.com and simone.ns.cloudflare.com. Technical fingerprints reveal a stack comprising PHP, ThinkPHP, Nginx, OpenResty, Vue.js, jQuery and HTTP Strict Transport Security. Reputation scoring is extremely low (Gridinsoft 0/100) and the domain appears on one public blocklist, currently blocked by PhishDestroy. VirusTotal analysis shows six of ninety‑three scanners flag the domain, and AlienVault OTX lists it in a single threat pulse. While the exact phishing page content has not been captured, the combination of a Bitget‑related title, cryptocurrency‑focused scam type, and low trust scores provides strong evidence of a malicious operation. Defenders should block the domain at perimeter filters, monitor DNS queries for 185.18.222.225, and add the host to internal blocklists. Users of Bitget should be warned to disregard any unsolicited login prompts referencing “Web3 Wallet” and to verify URLs before credential entry.