bitgetminers[.]pages[.]dev

bitgetminers.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. The domain resolves to 172.66.44.94, an IP address owned by AS13335 Cloudflare, Inc. in the United States. The site served a page titled “Suspected phishing site | Cloudflare” and returned an HTTP 403 response before being taken offline. The TLS certificate presented is issued by SSL Corporation / Cloudflare TLS Issuing ECC CA 3, typical for Cloudflare‑protected domains. Security telemetry shows the domain appears on a single blocklist (PhishDestroy) and is flagged by five of ninety‑five VirusTotal scanners.

Gridinsoft assigned a trust score of zero out of one hundred, indicating extreme suspicion. Detected technologies include HTTP/3, HSTS, and the Cloudflare network stack, consistent with the hosting provider. The campaign is classified as a crypto‑related brand impersonation targeting Bitget, as indicated by the “Impersonates: Bitget” tag and the “Crypto Scam” label. Current evidence does not reveal the exact payload or credential‑harvesting mechanisms; the page content beyond the title has not been captured.

Defenders should add the domain and its associated IP address to blocklists, monitor for any future re‑registration of similar sub‑domains, and enforce DNS filtering for Bitget‑related traffic. Continuous monitoring of Cloudflare‑issued certificates and rapid ingestion of the five VirusTotal detections into SIEM correlation rules are recommended to reduce exposure. Because the site is offline, immediate active mitigation is limited, but the indicators of compromise should be shared with upstream threat‑intelligence feeds to prevent reuse.