bitget-trolpix[.]pages[.]dev

Analysis of the domain bitget-trolpix.pages.dev indicates it was actively impersonating the cryptocurrency exchange Bitget, aligning with the classified scam type 'Crypto Scam' and the explicit brand target 'Bitget' provided in threat intelligence. The domain was registered on March 22, 2026, through Cloudflare, Inc., and was hosted on Cloudflare infrastructure, resolving to the IP address 188.114.96.3, located in Canada. Nameservers lisa.ns.cloudflare.com and viddy.ns.cloudflare.com, along with an SSL certificate issued by Google Trust Services (WE1), further confirm Cloudflare as the hosting and security provider. The domain was flagged by six out of 94 security vendors on VirusTotal, a detection rate that suggests elevated risk but does not confirm malicious activity on its own.

It appeared on at least one security blocklist and was blocked by PhishDestroy prior to being taken offline. The HTTP status returned a 403 Forbidden response, indicating access was restricted or the site was disabled at the time of analysis. Technologies detected on the domain include Vue.js, HSTS, and HTTP/3, which are consistent with modern web applications but do not inherently indicate malicious intent. The page title 'Bitget' directly matches the impersonated brand, reinforcing the likelihood of brand abuse.

Gridinsoft assigned a trust score of 0/100, reflecting a high-risk assessment based on available indicators. While the domain is currently offline, defenders should treat any future reactivation as a potential threat. Organizations are advised to monitor for related infrastructure, particularly domains using Cloudflare Pages with similar naming patterns or targeting cryptocurrency platforms. If this domain reappears, security teams should verify its legitimacy through direct communication with the official Bitget platform and consider proactive blocking based on historical indicators.