id-bitget[.]com

This domain, id-bitget.com, is actively impersonating the Aave cryptocurrency platform as part of a high-risk crypto scam operation. Registered on July 18, 2025, through Gname.com Pte. Ltd., the domain resolves to IP address 23.185.200.79, hosted on AS8796 (FASTNET DATA INC) in the United States. Infrastructure analysis reveals the use of nameservers a7.share-dns.com and b7.share-dns.net, which are commonly associated with malicious or abused hosting environments. The domain currently returns an HTTP 200 status, indicating an operational web server, and presents a page title of 'bittsget,' which does not match the expected branding of Aave but aligns with the domain's deceptive naming pattern. The domain appears on one security blocklist and is flagged by 2 of 95 security vendors on VirusTotal, suggesting limited but confirmed detection. Its Gridinsoft trust score is 0/100, further indicating malicious intent. The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious sites due to its free and automated issuance process. While the exact content of the site has not been analyzed, the combination of brand impersonation, cryptocurrency scam classification, and hosting on a known high-risk infrastructure warrants immediate defensive action. Defenders should treat this domain as active and malicious, prioritizing blocking at the DNS and network levels. Given its recent registration and confirmed scam classification, monitoring for related domains using similar naming conventions (e.g., 'bitget' variants) or shared infrastructure (nameservers, IP ranges) is recommended. Additional analysis of the site's content and scripts may reveal further indicators of compromise, such as wallet addresses or phishing kits, but this has not yet been conducted.