trdxm[.]site

The domain trdxm.site has been identified as a brand impersonation threat specifically targeting Bitget, a cryptocurrency exchange platform. This infrastructure was operational as a phishing site designed to deceive users into believing they were interacting with legitimate Bitget services. Analysis indicates the domain is currently offline, though prior activity suggests it was actively used for fraudulent purposes. Infrastructure analysis reveals the domain was created on October 21, 2025, and registered through NameCheap, Inc. It resolves to the IPv6 address 2a02:4780:42:ed5d:32b9:d693:41f8:a961, hosted on AS47583 (Hostinger International Limited) in Germany. The domain lacks an SSL certificate, increasing the likelihood of interception or manipulation of user data. Security vendors flagged trdxm.site in 9 of 95 VirusTotal scans, and it appears on two independent security blocklists. The page title, "FLARE - HOME," does not align with Bitget’s legitimate branding, further confirming its fraudulent nature. At present, trdxm.site has been taken offline, though its prior use as a phishing vector warrants continued monitoring. Organizations and users are advised to block the domain at the network level and review logs for prior connections to the IPv6 address. Cryptocurrency platforms should alert users to verify domain authenticity before engaging with any service claiming affiliation. Security teams are encouraged to treat any residual traffic to this domain as indicative of compromise and investigate accordingly.