bitget-bne[.]hl[.]cn

Analysis of bitget-bne.hl.cn shows a clear pattern of brand impersonation targeting the cryptocurrency exchange Bitget. The domain, created on March 04, 2026 and registered through Web Commerce Communications Limited, resolves to IP address 107.151.64.66, which is hosted in Hong Kong under AS132839 POWER LINE DATACENTER. Infrastructure inspection reveals an Nginx web server that enforces HTTP Strict Transport Security (HSTS) and supports HTTP/3, indicating a relatively modern configuration. The site presents a Let's Encrypt TLS certificate, which is commonly used by both legitimate services and malicious actors.

The page title returned by the server – "Bitget官网直达 - 注册开户享专属优惠 | 行业竞争力费率 2026" – directly references the Bitget brand and includes promotional language, reinforcing the impersonation motive. VirusTotal scans report that 10 out of 94 security vendors have flagged the domain, suggesting a non‑trivial detection consensus. The domain is listed on at least one active blocklist, specifically PhishDestroy, confirming that external threat‑intelligence feeds have identified it as malicious.

Current operational status is offline, but the presence of the domain on blocklists and the vendor detections indicate that it may have been used previously or could be reactivated. Defenders should immediately add 107.151.64.66 to network‑level deny lists, block the hostnames associated with the shared DNS providers (a.share-dns.com, a1.share-dns.com, b.share-dns.net, b1.share-dns.net), and monitor for any re‑appearance of the domain or related subdomains. Continuous scrutiny of TLS certificates issued by Let's Encrypt for brand‑related domains is advised, as is the inclusion of this indicator in threat‑intel feeds to prevent future impersonation campaigns against Bitget customers.