bitgetlyer2[.]com

This domain, bitgetlyer2.com, was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IPv4 address 45.192.219.162, which is assigned to Antbox Networks Limited in Hong Kong (AS138995). The site is served by Nginx, delivers a Vue.js front‑end, and enforces HTTP Strict Transport Security. A Let’s Encrypt R13 certificate protects the HTTPS connection, indicating a publicly trusted TLS layer. VirusTotal records show that two of ninety‑five scanning engines flagged the domain, confirming malicious intent.

The domain appears on a single security blocklist and has been actively blocked by PhishDestroy, reinforcing its classification as a crypto‑related brand impersonation targeting Bitget users. Nameserver records point to a4.share-dns.com and b4.share-dns.net, a pattern commonly observed in fast‑flux or disposable hosting setups. The current HTTP status is offline, but the infrastructure components remain observable and may be re‑used for future campaigns. Defenders should immediately add bitgetlyer2.com and its resolving IP 45.192.219.162 to deny lists, monitor for any resurgence of the host, and apply domain‑level heuristics that flag look‑alike constructions of the Bitget brand.

Continuous scrutiny of new domains registered by the same registrar or using the same nameservers is advisable, as adversaries often recycle these assets. Integrating the detection of Vue.js/Nginx stacks with HSTS into network‑level inspection can also aid in early identification of similar impersonation sites. Threat intelligence platforms should correlate this indicator with other Bitget‑related abuse reports to identify potential campaign overlap. Organizations that support cryptocurrency transactions should enforce multi‑factor authentication and educate users about unsolicited requests referencing Bitget.