bitget-x-lgn[.]pages[.]dev

The domain bitget-x-lgn.pages.dev is a phishing site engaged in brand impersonation targeting Bitget, a cryptocurrency exchange. It presents a fraudulent login page designed to harvest user credentials, posing an elevated risk of account takeover. No cryptocurrency drainer kit was detected. The site is currently taken offline, but prior activity indicates it was actively used for credential theft under the guise of the legitimate Bitget platform.

Technical indicators confirm the malicious nature of bitget-x-lgn.pages.dev. The domain was flagged by 1 of 95 VirusTotal security vendors, including Phishing Database, and appears on 1 security blocklist (PhishDestroy). Registered through Cloudflare, Inc. on September 22, 2025, it resolves to the IP address 188.114.97.3, hosted by Cloudflare in Canada. The SSL certificate is issued by Google Trust Services (WE1), and the observed page title was 'Bitget — Login'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with a Gridinsoft trust score of 0/100. Google Safe Browsing did not flag the domain at the time of analysis.

Users who interacted with bitget-x-lgn.pages.dev should immediately change their Bitget account passwords and enable two-factor authentication (2FA) to prevent unauthorized access. Monitor account activity for signs of fraud, such as unauthorized transactions or login attempts. Report the phishing domain to Bitget’s official support channels and submit it to platforms like Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.