bitgetiai[.]com

This domain, bitgetiai.com, is identified as a high-risk brand impersonation threat targeting Bitget, a cryptocurrency exchange platform. Analysis indicates the site masqueraded as the legitimate Bitget platform, likely to deceive users into disclosing credentials or transferring funds. The page title, 'BITGET,' aligns with the impersonation tactic, reinforcing the fraudulent intent. No direct evidence of a crypto drainer kit was observed, but the domain’s structure and content suggest it was designed for credential harvesting or financial fraud. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on February 28, 2026, an anomalous future date that may indicate registry manipulation or typo-squatting. It resolved to the IP address 162.245.220.29, hosted under AS150452 (LANDUPS LIMITED) in Hong Kong. Google Safe Browsing flagged the domain as phishing, and VirusTotal reported 17 out of 95 security vendors detecting it as malicious. Additionally, the domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (R12), a common choice for both legitimate and malicious sites. As of the latest assessment, bitgetiai.com has been taken offline, likely due to enforcement actions such as domain suspension or hosting provider intervention. While the immediate threat has been mitigated, residual risks persist, including potential re-registration or migration of the phishing infrastructure to alternative domains. Organizations and users are advised to monitor for similar impersonation attempts, particularly those leveraging cryptocurrency brands, and to verify domain registration dates and SSL certificates as part of routine security checks. Blocking the IP address 162.245.220.29 and domains registered under the same ASN may help mitigate related threats.