bitget-wallet[.]io

PhishDestroy identifies bitget-wallet.io as an active crypto-drainer domain deliberately impersonating Bitget. The domain leverages a Let’s Encrypt SSL certificate to appear legitimate and resolve to IP 172.67.136.141, a known cloud hosting address. With no VirusTotal detections (1/95 engines at time of analysis), this domain remains under the radar despite its malicious intent. Registrar NameSilo, LLC shows domain creation on April 13, 2026—indicating a recently stood-up threat designed for quick exploitation before takedown efforts. The specific threat posed by bitget-wallet.io is credential theft and fund draining in the cryptocurrency sector. Users lured via social engineering to this domain are prompted to connect their crypto wallets, after which malicious scripts execute unauthorized transactions to drain assets. The domain closely mirrors Bitget branding—targeting users expecting legitimate wallet integrations or API endpoints. Recent registration date and zero detections signal a short-lived campaign likely spreading through spam or fake support channels. Organizations and users should immediately block 172.67.136.141 and blocklist bitget-wallet.io at DNS level. If visited, disconnect wallet immediately, revoke any connected permissions using tools like Etherscan or WalletConnect, and monitor for anomalous transactions. Report this domain to security teams, phishing feeds, and domain registrars for swift action.