bitgetio[.]icu

The domain bitgetio.icu was created on February 21, 2026 and is currently resolved to the IPv4 address 185.18.222.225, which is announced by AS396356 and geolocated in Japan. Registration was performed through Dynadot LLC, and the authoritative nameservers are ryan.ns.cloudflare.com and simone.ns.cloudflare.com. The site serves a page titled "Web3 Wallet Login" and returns an HTTP 302 response, indicating a redirect flow. Technical fingerprinting shows a stack comprising PHP, ThinkPHP, Nginx, Vue.js, OpenResty, jQuery, and HSTS, secured with a Let’s Encrypt certificate (E7). The domain is listed on a single security blocklist, has been blocked by PhishDestroy, and receives a Gridinsoft trust score of 0/100. VirusTotal analysis reports three detections out of ninety‑three scanners. The campaign is classified as a high‑risk, brand‑impersonation crypto scam targeting Bitget users. Defenders should immediately add bitgetio.icu and its resolving IP 185.18.222.225 to web‑filter deny lists, monitor for related DNS or IP artifacts, and enforce user education about unsolicited Web3 wallet login prompts that reference Bitget. Continuous threat‑intel correlation is advised to detect potential replica infrastructure or evolving payloads.