bitget-token[.]info

This domain, bitget-token.info, is identified as a high-risk brand impersonation threat targeting Bitget, a cryptocurrency exchange platform. Analysis indicates the domain is designed to deceive users into believing it is an official Bitget token-related page, as suggested by the page title 'BITGET-TOKEN.' The threat type is classified as brand impersonation with phishing intent, likely aiming to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain is flagged by 11 out of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly marking it as phishing. The domain resolves to IP address 43.212.99.130, hosted on Amazon.com, Inc. infrastructure (AS16509) in Taiwan. No SSL certificate is present, increasing the risk of man-in-the-middle attacks. The domain appears on one security blocklist and is currently blocked by PhishDestroy. Registrar details and creation date are not provided, but the lack of encryption and active phishing flags suggest recent deployment. As of the latest assessment, bitget-token.info remains active, posing a continued risk to users. Immediate mitigation steps include blocking the domain and its associated IP at the network perimeter. Organizations should update endpoint protection rules to flag interactions with this domain as malicious. Users are advised to verify domain authenticity before entering credentials or conducting transactions, particularly on pages lacking SSL encryption. The absence of a valid certificate and the domain's presence on multiple threat intelligence feeds underscore the need for heightened vigilance.