bitget[.]lol

This domain, bitget.lol, was observed delivering a tech support scam that masquerades as Apple. The site was registered through Dynadot LLC on March 24, 2025 and resolves to IP address 104.18.8.145, which belongs to Cloudflare, Inc. (AS13335) in the United States. The SSL certificate presented is issued by RapidSSL TLS RSA CA G1, indicating that TLS is available but does not imply legitimacy. The page title retrieved from the site reads “在Bitget注册以获得最高6,200 USDT的奖金 | Bitget”, referencing a cryptocurrency incentive unrelated to Apple, suggesting the domain may be part of a broader lure chain. Reputation services assign extremely low trust scores: Scamadviser rates the domain 1 out of 100 and Gridinsoft rates it 0 out of 100.

The domain appears on three security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX lists the domain in one threat intelligence pulse, reinforcing its malicious classification. VirusTotal analysis shows that four of ninety‑five security vendors flagged the domain, providing additional detection confidence. The current HTTP status is offline, which may be a temporary takedown or operational pause.

Defenders should add bitget.lol to deny‑list rules, enforce DNS sinkholing for the associated IP 104.18.8.145, and monitor for newly registered domains using the same registrar or similar naming patterns. Continuous monitoring of Cloudflare‑hosted IP ranges for unexpected tech‑support‑related traffic is advised, as is reviewing any outbound connections from internal hosts to this address. Because the site claims a crypto bonus, security teams should also watch for related cryptocurrency‑related phishing campaigns that could leverage the same infrastructure. In environments where Apple credentials are used, alerts for authentication attempts to unknown endpoints should be tuned to capture any residual activity from this domain.