bitgetsdd[.]cexgfvi[.]cn

The domain bitgetsdd.cexgfvi.cn was registered on October 22, 2025 by the entity identified as 邦宁数字技术股份有限公司. It resolves to the IPv4 address 180.97.215.93, which belongs to AS4134 CHINANET-BACKBONE and is geolocated in China. The host is served by Nginx and presents a front-end built with Vue.js, jQuery, and HTTP/3 support, while HSTS is advertised despite the absence of an SSL certificate. The site’s page title reads "Login - Bitget", and the intelligence tags it as a crypto-scam that impersonates the legitimate Bitget exchange platform.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy. Reputation scoring from Gridinsoft assigns a zero-out-of‑one‑hundred trust rating, and VirusTotal reports that seven of ninety-four scanning engines flag the domain as malicious. The domain is currently taken offline, and no active HTTPS service is observed. The registrar information, the use of Chinese name servers ns1.judns.com and ns2.judns.com, and the hosting under a large Chinese backbone suggest a threat actor leveraging local infrastructure to host credential‑harvesting pages aimed at cryptocurrency users.

Defenders should add the domain and its resolving IP to blocklists, monitor DNS queries for the cexgfvi.cn suffix, and enforce strict outbound filtering for connections to the identified IP range. Because the site lacks TLS, network‑level TLS inspection will not reveal additional payloads, but intrusion detection signatures that flag HTTP requests containing the "Login - Bitget" title or the specific path patterns observed in related campaigns may be useful. Continuous re‑evaluation is advised, as the offline status could change if the operators reactivate the site or deploy new variants under the same registrar or nameserver set.