bitgetwalettapp[.]com

Analysis of the domain bitgetwalettapp.com indicates it was a brand-impersonation threat targeting Bitget, a cryptocurrency exchange. The domain was registered on February 21, 2026, through Tucows Domains Inc. and resolved to the IP address 104.21.81.97, hosted on Cloudflare's network (AS13335) in the United States. Infrastructure analysis reveals the use of Cloudflare nameservers (dorthy.ns.cloudflare.com and venkat.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site was detected by 15 of 93 security vendors on VirusTotal, and it appeared on at least one security blocklist.

Additionally, the domain was flagged in one AlienVault OTX threat intelligence pulse, further confirming its malicious classification. The page title, 'Suspected phishing site | Cloudflare,' aligns with its identification as a crypto scam, as explicitly noted in available threat intelligence. The domain has since been taken offline, though its prior infrastructure and detection history suggest it was actively used in a phishing campaign.

Defenders should treat this domain as a confirmed malicious entity, particularly in environments where Bitget or cryptocurrency-related services are accessed. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, detection by multiple security vendors, and its presence on blocklists provides sufficient evidence to classify it as a high-risk threat. Monitoring for related domains registered through the same registrar or resolving to similar Cloudflare-hosted IPs may help identify further iterations of this campaign.