bitfiyer-bfba-18abc[.]bitfiyer-mzkje[.]com

Analysis of the domain bitfiyer-bfba-18abc.bitfiyer-mzkje.com indicates an active cryptocurrency‑related impersonation campaign targeting BitGet users. The site was registered on 26 September 2025 through GoDaddy.com, LLC and resolves to the IPv4 address 162.245.220.172, which is assigned to AS150452 LANDUPS LIMITED in Hong Kong. The hosting server presents a Let’s Encrypt R12 SSL certificate, confirming that TLS is in place but offering no assurance of legitimacy. DNS resolution is provided by ns17.domaincontrol.com and ns18.domaincontrol.com, both standard GoDaddy name servers. The page title returned from the HTTP response is "BitGet," matching the declared brand target and reinforcing the likelihood of brand impersonation.

Threat intelligence aggregators have flagged the domain on multiple fronts. VirusTotal reports 12 detections out of 93 scanned engines, reflecting a moderate consensus among security vendors that the site is malicious. Independent blocklist services PhishDestroy and ScamSniffer have listed the domain, and two additional security blocklists are known to contain it, indicating broader community awareness. The Gridinsoft trust score is 0 out of 100, reinforcing the classification as a high‑risk resource. The site is currently reported as offline, which may be a temporary takedown or a shift in infrastructure.

While the exact payload or phishing page content has not been disclosed, the classification as a "Crypto Scam" suggests attempts to harvest credentials or lure victims into fraudulent cryptocurrency transactions. Defenders should continue to block the domain at network perimeters, update DNS filtering policies, and monitor for any re‑appearance of the same infrastructure, especially the IP address 162.245.220.172 and the associated Let’s Encrypt certificate. Further investigation of outbound traffic to the listed IP and correlation with user reports of BitGet credential theft are recommended.