bitfiyer-34b5-36e53[.]bitfiyer-smzk[.]com

The domain bitfiyer-34b5-36e53.bitfiyer-smzk.com was registered on September 26, 2025 and is presently taken offline. It resolves to the IPv4 address 162.245.220.172, which is advertised as belonging to Hong Kong under AS150452 (LANDUPS LIMITED). The domain is hosted by GoDaddy.com, LLC and uses the authoritative name servers ns69.domaincontrol.com and ns70.domaincontrol.com. TLS termination is provided by a Let’s Encrypt certificate (R12), indicating that HTTPS was served at some point. Gridinsoft assigns a trust score of 0 out of 100, reflecting a highly suspicious reputation.

The page title observed during the brief analysis was "BitGet," matching the targeted brand BitGet as indicated by the intelligence feed. VirusTotal scanned the domain and recorded three positive detections out of ninety-three security vendors, confirming that multiple anti-malware engines have flagged the site as malicious. The domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer, further corroborating its classification as a crypto‑related scam. The primary threat vector is brand impersonation, leveraging the BitGet name to lure victims into a cryptocurrency fraud scheme. No additional payload or post‑exploitation details are currently available because the site is offline, and no HTTP response body has been captured.

Defenders should immediately block the domain and its resolving IP address at perimeter firewalls and DNS filtering layers. Continuous monitoring of the associated ASN and any future DNS changes is advised, as adversaries often re‑use infrastructure. Updating intrusion detection signatures with the observed TLS fingerprint and the low Gridinsoft trust score can improve detection of similar campaigns. Incident response teams should also audit internal logs for any connections to the listed IP or domain within the past 30 days to identify potential exposure.