bitget-login-start[.]pages[.]dev

The domain bitget-login-start.pages.dev was observed on July 12, 2026 and classified as a high‑risk brand‑impersonation site targeting Bitget users. The domain was registered on February 21, 2026 through Cloudflare, Inc., and its current status remains active. The page title returned by the server is “Worker threw exception | bitget-login-start.pages.dev | Cloudflare,” indicating a Cloudflare‑served endpoint that is currently returning an HTTP 500 response.

Infrastructure analysis shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Authoritative nameservers are rose.ns.cloudflare.com and kipp.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The TLS certificate is issued by Google Trust Services under the WE1 designation, providing a valid HTTPS connection despite the underlying server error.

Threat intelligence flags the site as a cryptocurrency‑related brand impersonation campaign. VirusTotal has recorded a single positive detection out of 95 scanned security vendors, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on one external blocklist and is explicitly blocked by the PhishDestroy filtering service. The combination of a high risk rating, active status, and low trust metrics underscores the malicious intent.

Defenders should add the domain and its associated IP address to network‑level deny lists and ensure that any outbound connections to the Cloudflare‑served endpoint are blocked. Email security gateways should be updated to flag messages containing URLs that reference bitget-login-start.pages.dev, especially those claiming to originate from Bitget. Continuous monitoring of the IP’s ASN and associated DNS records is advised to detect potential re‑hosting or variant activity.