bitgetvn[.]com

The domain bitgetvn.com is currently active and hosts a crypto‑scam infrastructure that masquerades as the legitimate Bitget service. Registration data shows the domain was created on 30 July 2025 through the registrar Cosmotown, Inc. DNS resolution points to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc., located in the United States. Both authoritative name servers are aiden.ns.cloudflare.com and lina.ns.cloudflare.com, indicating Cloudflare’s DNS‑hosting service. An SSL certificate issued by Google Trust Services (WE1) is present, confirming HTTPS support. HTTP requests return a 521 status code, which is a Cloudflare‑specific error indicating that the origin server is offline or refusing connections. Technology fingerprints collected from the page include PHP, the ThinkPHP framework, Bootstrap, and client‑side libraries such as jQuery, jsDelivr, and cdnjs, all delivered over HTTP/3 via Cloudflare’s edge network. The page title returned by the server is “bitgetv”, which aligns with the reported brand target “bitget”. VirusTotal records show that one of ninety‑five security vendors flagged the domain, and the domain appears on a single security blocklist. It has been blocked by PhishDestroy and carries a Gridinsoft trust score of 0/100, reinforcing the high‑risk assessment. Evidence confirms that bitgetvn.com is being used to impersonate Bitget in a cryptocurrency‑related scam. However, the exact content and user‑facing pages have not been captured, so the full scope of the fraudulent payload remains unknown. Defenders should immediately block the domain at network perimeters, add it to internal URL filtering lists, and monitor for any related DNS or SSL certificate changes. Continuous observation of Cloudflare‑associated IP ranges and rapid sharing of newly observed indicators with threat‑sharing communities are recommended to mitigate further abuse.