newshare[.]bwb[.]digital

Analysis of the domain newshare.bwb.digital shows that it was created to impersonate the cryptocurrency exchange Bitget by promising a “Bitget Wallet Rewards” airdrop. The only publicly visible indicator is the page title “Visit the Bitget Wallet Rewards page to claim multiple token rewards!” which aligns with a fake‑airdrop scam profile. The domain is registered through PDR Ltd. d/b/a PublicDomainRegistry.com and is served behind Cloudflare’s network (AS13335) with the IP address 104.21.50.164 located in the United States. Cloudflare’s HTTP/3 support and the nameservers june.ns.cloudflare.com and nikon.ns.cloudflare.com confirm that the infrastructure is fully cloud‑hosted, a common choice for rapid deployment of malicious pages. A VirusTotal scan returned a single positive detection out of 94 vendors, indicating at least one security product flagged the site.

The domain also appears on a single blocklist operated by PhishDestroy, which has added it to its phishing database. An HTTP request to the host returns a 404 status code, and the site is presently taken offline, limiting immediate access for victims. The evidence set therefore consists of registrar information, hosting details, the deceptive page title, the blocklist entry, and the single VirusTotal flag. No additional artifacts such as SSL certificate anomalies, malicious payloads, or credential‑stealing forms have been observed.

Because the domain is already offline, active mitigation focuses on updating detection rules and threat‑intel feeds. Defenders should add the domain and its associated IP address to blocklists, monitor for any re‑registration or similar naming patterns, and incorporate the page‑title string into URL‑filtering policies. Continuous observation of Cloudflare‑hosted IP ranges for new domains that reference “Bitget” or “Wallet Rewards” is recommended to catch future impersonation attempts early.