bitfiyer-6e34-7546b[.]bitfiyer-mzkje[.]com

This domain is flagged as an elevated-risk crypto drainer phishing infrastructure specifically designed to impersonate BitGet, a cryptocurrency exchange platform. Analysis indicates the threat actor deployed a fake login interface to harvest credentials and execute unauthorized transactions, a tactic commonly associated with cryptocurrency theft operations. The domain exhibits characteristics of a short-lived, high-impact phishing campaign, targeting users through brand impersonation and social engineering techniques.

Infrastructure analysis reveals the following technical indicators: the domain bitfiyer-6e34-7546b.bitfiyer-mzkje.com was registered through GoDaddy.com, LLC on September 26, 2025, and resolved to the IP address 162.245.220.172. VirusTotal detections show 8 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigned a trust score of 0/100. The domain appears on two security blocklists, including ScamSniffer and PhishDestroy, and was taken offline following detection. The page title displayed "BitGet," further confirming the intent to deceive users into believing the site was legitimate.

Mitigation steps for organizations and end-users include immediate blocking of the domain and its associated IP address (162.245.220.172) at the network perimeter. Cryptocurrency exchange users should enable multi-factor authentication (MFA) and verify domain authenticity before entering credentials. Security teams are advised to monitor for similar domains registered through GoDaddy or other large registrars, particularly those using randomized subdomains or slight misspellings of legitimate brands. Incident responders should examine logs for connections to 162.245.220.172 and review wallet transaction histories for unauthorized activity linked to this phishing campaign.