bitgetai[.]club

Analysis indicates bitgetai.club operates as an active impersonation of the Bitget brand targeting cryptocurrency users through a Web3 wallet login page. The domain was registered via Dynadot LLC on February 21 2026 and currently resolves to IP address 185.18.222.225 located in Japan. It returns an HTTP 302 status and presents the exact page title Web3 Wallet Login while employing technologies including PHP ThinkPHP Nginx Vue.js OpenResty jQuery and HSTS. Nameservers listed are ryan.ns.cloudflare.com and simone.ns.cloudflare.com with an SSL certificate issued by Let's Encrypt under serial E8.

Infrastructure analysis reveals the domain appears on one security blocklist and records a Gridinsoft trust score of 0/100. VirusTotal detection stands at 2 out of 95 vendors. The impersonation matches known patterns of cryptocurrency scams that redirect visitors to harvest wallet credentials. The site remains reachable and has not been taken down as of the July 12 2026 report date.

Defenders should treat any traffic to this domain as high risk and block it at network and endpoint layers. Blocking the resolving IP 185.18.222.225 and monitoring for similar subdomains under the .club TLD are immediate steps. Because the domain uses Cloudflare nameservers investigators must also review associated edge configurations when correlating logs. Continued observation of the HTTP 302 responses can reveal redirect chains used to evade simple filters.

Uncertainty remains around the full extent of credential collection infrastructure behind the 302 responses and whether additional domains share the same backend. No direct evidence confirms the exact phishing kit in use although the listed technologies suggest a custom stack rather than a mass-produced template. Regular rechecking of the domain status and integration of the provided IP and nameserver indicators into threat feeds will help maintain coverage against this impersonation campaign.