h5[.]higico[.]top

PhishDestroy identifies h5.higico.top as an active brand impersonation page targeting Bitget users. This domain was flagged by 10 of 95 VirusTotal security vendors, confirming malicious intent. Registered through Hongkong Kouming International Limited on February 11, 2026, the site resolves to IP 223.26.62.92 and employs a Let's Encrypt SSL certificate to appear legitimate. Its page title matches Bitget’s branding, creating a deceptive user experience designed to harvest login credentials or financial details.
This domain’s high-risk status reflects its recent creation, low detection rate, and direct impersonation of a major cryptocurrency exchange. At just days old, h5.higico.top evades broader blocklists due to minimal flagging, allowing it to operate undetected. The precise threat is credential theft via a spoofed Bitget login portal, where user inputs are siphoned to attacker-controlled infrastructure. Technical indicators include the use of a valid SSL certificate to bypass browser warnings, a domain name designed to resemble Bitget’s official subdomains, and targeting of users through phishing emails or fake ads. The combination of recent registration, specific impersonation, and partial detection suggests an emerging campaign actively seeking victims.
If you visited h5.higico.top or entered credentials, immediately change your Bitget password from a known-safe device and enable two-factor authentication. Scan your device for malware using a reputable antivirus tool, as this site may have deployed infostealers. Report the domain to Bitget’s security team via their official channels and your local cybercrime unit. Avoid clicking links from unsolicited messages; always verify URLs by typing them manually or using bookmarks. Block the IP 223.26.62.92 and domain h5.higico.top via your firewall or network settings to prevent further exposure. Exercise heightened caution with all cryptocurrency-related communications, as threat actors frequently exploit brand trust in this sector.