bitwalletmarket[.]ltd

This domain, bitwalletmarket.ltd, has been identified as a brand impersonation threat specifically targeting Google. Analysis indicates the page title, 'Bitwalletmarket – welcome to Bitwalletmarket,' mimics legitimate service nomenclature to deceive users into believing the site is associated with the targeted brand. No direct evidence of a crypto drainer kit was observed, but the domain's infrastructure and design suggest intent to harvest credentials or distribute malicious payloads under the guise of a trusted entity. The threat type aligns with typical brand abuse tactics, where attackers exploit familiarity to lower user defenses. Infrastructure analysis reveals the domain was registered through Global Domain Group LLC on November 19, 2025, and resolves to the IP address 198.12.80.250. Detection metrics show 13 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist, specifically PhishDestroy. The domain's SSL certificate is issued by Let's Encrypt, a common tactic to lend superficial legitimacy. Gridinsoft assigns a trust score of 0/100, reinforcing the high-risk classification. No entries were found in Google Safe Browsing at the time of analysis, though this does not preclude prior or future listings. The domain is currently offline, likely due to takedown actions or infrastructure adjustments by the threat actor. However, the risk remains elevated due to the domain's recent registration and the potential for reactivation under altered parameters. Users and organizations are advised to block the domain and its associated IP at the network level. Monitoring for similar domains registered through the same registrar or resolving to the same IP range is recommended to preemptively mitigate related threats. Vigilance is particularly warranted for users who may have interacted with the domain prior to its takedown, as credential exposure or secondary infections cannot be ruled out.