deote[.]top

Analysis of the domain deote.top, created on January 17 2026 and registered through NameSilo, LLC, indicates a high‑risk brand‑impersonation campaign targeting Bitget users. The site was hosted on Cloudflare infrastructure, resolving to IP 172.67.189.204 (AS13335, United States) and using the authoritative nameservers bonnie.ns.cloudflare.com and zod.ns.cloudflare.com. No TLS certificate was observed, meaning the site was reachable only via HTTP, which is consistent with many rapid‑deployment phishing kits. The page title returned by the server was "USDT支付收银台", suggesting a checkout page that solicits USDT payments, a common lure in cryptocurrency‑related fraud.

Google Safe Browsing flagged the domain for social engineering, and VirusTotal recorded 16 of 93 security vendors marking it as malicious, reinforcing the phishing assessment. Independent security tools rated the site extremely poorly; Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already taken the site offline, and current network scans confirm the domain is not serving content. While the exact page layout and credential‑capture mechanisms remain unverified, the combination of brand impersonation, payment‑oriented title, and multiple vendor detections provides strong evidence of a phishing operation.

Defenders should block deote.top at DNS and network layers, add its IP address to outbound‑traffic deny lists, and monitor the Cloudflare nameservers for new domains that may reuse the same hosting pattern. Continuous observation of NameSilo registrations for similarly structured domains is advised, as threat actors often recycle registrars and naming conventions. Organizations using Bitget services should alert users to the existence of this impersonation attempt and reinforce security awareness around unsolicited USDT payment requests.