bitget[.]promo

The domain bitget.promo was observed resolving to 104.21.80.1, a Cloudflare edge address associated with ASN 13335 in the United States. The domain is hosted on Cloudflare's network and uses the nameservers houston.ns.cloudflare.com and lara.ns.cloudflare.com. No TLS certificate was presented at the time of analysis, indicating the site was served over plain HTTP before being taken offline. The page title returned by the HTTP response reads "Bitget Investment| Reliable and Profitable Investment in Binary Options, Forex, Indices, CFD's", which explicitly references the legitimate Bitget brand and attempts to lure victims into binary options, forex and CFD investments. The listed scam type is a crypto scam, and the domain is flagged as impersonating the Bitget brand.

VirusTotal scans show five of ninety‑five security vendors flagging the domain as malicious, and the domain appears on a single security blocklist, specifically PhishDestroy. Reputation services assign low trust scores: Scamadviser 21 out of 100 and Gridinsoft 18 out of 100, reinforcing the malicious assessment. Registration was performed through NameCheap, Inc., a registrar frequently used by malicious operators to obtain disposable registrations. The current operational status is offline, which limits real‑time observation of payloads or credential‑stealing pages.

Consequently, the exact content, redirection behavior, or any embedded scripts remain unverified. Analysts should treat the domain as a confirmed brand‑impersonation vector targeting Bitget users and investors interested in cryptocurrency or binary‑options trading. Defensive actions include adding the domain and its resolved IP address to network blocklists, updating URL filtering policies, and monitoring for any resurgence of the domain or similar look‑alike registrations. Continuous telemetry from DNS, HTTP, and SSL monitoring is recommended to detect re‑activation or new domains employing the same brand‑spoofing pattern.