bitfiyer-4071-5f23b[.]bitfiyer-smzk[.]com

This domain, bitfiyer-4071-5f23b.bitfiyer-smzk.com, is flagged for brand_impersonation targeting the cryptocurrency exchange BitGet. Analysis indicates the domain was designed to mimic the legitimate platform, likely to deceive users into disclosing credentials or transferring funds under false pretenses. No specific drainer kit signatures were identified in available intelligence, though the domain structure suggests a high likelihood of credential harvesting or wallet-draining functionality. Infrastructure analysis reveals the domain was registered on September 26, 2025, through GoDaddy.com, LLC. It resolves to the IP address 162.245.220.172, which has been associated with prior malicious activity. VirusTotal reports 7 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on three security blocklists, including ScamSniffer and PhishDestroy, and was previously blocked by OISD. The page title, BitGet, further confirms the intent to impersonate the legitimate exchange. As of the latest assessment, the domain has been taken offline, reducing immediate exposure risk. However, residual threats persist, including potential reuse of the IP address or registration of similar domains. Organizations should monitor for related indicators of compromise, such as the IP 162.245.220.172, and update blocklists to include this domain. Users are advised to verify exchange URLs via official channels and enable multi-factor authentication to mitigate credential theft risks.