bitget-login-io[.]pages[.]dev

The domain bitget-login-io.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site is presently offline, returning HTTP 403 responses, and the page title presented by Cloudflare reads "Suspected phishing site | Cloudflare," indicating that the hosting provider has flagged the content as malicious. An SSL certificate issued by Google Trust Services (WE1) is present, and the site advertises HSTS and HTTP/3 via Cloudflare's edge network.

Security intelligence shows that one of ninety‑three VirusTotal scanners flagged the domain, and it appears on a single security blocklist, specifically PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The domain explicitly impersonates the cryptocurrency exchange Bitget, as noted in the brand target field, and the scam type is identified as a crypto scam.

Defenders should treat the domain as a confirmed threat: block the hostname and its resolved IP address at perimeter firewalls, DNS filters, and proxy layers; update intrusion detection signatures to include the domain and associated Cloudflare nameservers (rose.ns.cloudflare.com, kipp.ns.cloudflare.com). Continuous monitoring of newly registered subdomains under the pages.dev namespace is advised, as threat actors often reuse similar patterns. Because the site is offline, no live content analysis is possible, and the exact phishing payload remains unknown; however, the combination of a flagged page title, low trust score, and presence on a phishing blocklist provides sufficient evidence to warrant immediate remediation and heightened awareness for any user attempts to access Bitget login portals.