bitfiyer-2465-cd697[.]bitfiyer-akwqm[.]com

This domain, bitfiyer-2465-cd697.bitfiyer-akwqm.com, is flagged for brand impersonation targeting BitGet, a cryptocurrency exchange platform. Analysis indicates the infrastructure was designed to mimic the legitimate BitGet interface, as evidenced by the page title "BitGet" and the domain structure incorporating the brand name. No direct evidence of a crypto drainer kit was observed, but the domain aligns with common tactics used to harvest credentials or facilitate fraudulent transactions under the guise of a trusted service. Infrastructure analysis reveals the domain was registered through GoDaddy.com, LLC on October 19, 2025, and resolves to the IP address 162.245.220.172. VirusTotal detections show 6 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on two security blocklists and is explicitly blocked by ScamSniffer and PhishDestroy. No Google Safe Browsing (GSB) entries were identified at the time of analysis, though this may reflect a lag in reporting rather than an absence of risk. The domain is currently offline, likely due to takedown efforts or abandonment by the threat actor. However, the infrastructure remains a residual risk until DNS records are fully purged and the IP address is re-evaluated for malicious associations. Users who interacted with the domain should assume credential exposure and monitor accounts for unauthorized activity. Organizations are advised to update blocklists with the domain, IP, and associated indicators to prevent future access attempts. The creation date and rapid detection by security vendors suggest this was a short-lived but targeted campaign.