bitgetones[.]net

This domain, bitgetones.net, is identified as a high-risk phishing infrastructure designed to impersonate BitGet, a cryptocurrency exchange platform. Analysis indicates the site employs brand impersonation tactics, presenting a fraudulent login interface under the page title 'BitGet' to deceive users into disclosing credentials or transferring assets. No direct evidence of a crypto drainer kit was observed, but the domain aligns with known patterns of credential harvesting and financial fraud targeting crypto wallet holders.

Technical indicators confirm the domain's malicious nature. VirusTotal reports 12 out of 95 security vendors flagging bitgetones.net as malicious, while it appears on one security blocklist. The domain was registered through GoDaddy.com, LLC on September 12, 2025, and resolves to the IP address 162.245.220.207, hosted under AS150452 (LANDUPS LIMITED) in Hong Kong. Google Safe Browsing has classified the domain as phishing, and it is actively blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt (R12), a common choice for threat actors due to its free and automated issuance process.

As of the latest assessment, bitgetones.net has been taken offline, likely in response to detection and reporting. However, residual risk persists due to the domain's recent registration and the potential for threat actors to redeploy the infrastructure under a new domain or IP address. Organizations and users are advised to monitor for similar impersonation attempts, particularly those targeting cryptocurrency platforms. Network defenders should update blocklists to include this domain and its associated IP, while users should verify the authenticity of any BitGet-related communications or login portals through official channels.