web3-bitget[.]net[.]in

web3-bitget.net.in entered the PhishDestroy evidence set on Feb 3, 2026. The hostname explicitly references Bitget; stored content metadata identifies the same apparent target. Content analysis also recorded brand signals for Ledger. The stored content classification is seed phrase theft. The assembled evidence scores 85/100 (high).

Two independent sources are positive: VirusTotal and URLQuery. VirusTotal recorded 3 detections among 93 engines: Gridinsoft, Netcraft, SOCRadar on Jul 18, 2026 at 18:45 UTC. URLQuery recorded 1 threat-system alert on Feb 3, 2026 at 18:05 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict (score 0) on Mar 28, 2026 at 12:05 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 02:16 UTC; content was unavailable. Registration records for the domain list Dynadot LLC as the registrar. At collection time, the hostname resolved to 149.30.242.118 on AS133199 (SONDERCLOUDLIMITED-AS-AP SonderCloud Limited, HK). The associated network metadata labels the endpoint as AS133199 SonderCloud Limited in Tung Chung, HK. The stored server header is nginx/1.20.1. Captured page title: “web3-bitget.net.in/”. DOM analysis completed on Apr 23, 2026 at 07:20 UTC; stored DOM score 85/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. IoC extraction completed on Jul 29, 2026 at 02:37 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

Taken together, the page content and independent findings support classifying this hostname as Bitget-themed seed phrase theft.