bitnest[.]me

Analysis conducted on 22 July 2026 identifies bitnest.me as an active brand‑impersonation infrastructure targeting Binance users. The site was registered on 21 February 2026 through GANDI SAS and resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (AS13335) located in the United States. DNS resolution is provided by the Cloudflare nameservers COBY.NS.CLOUDFLARE.COM and KATE.NS.CLOUDFLARE.COM. The TLS certificate is issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS service. HTTP requests return a 403 status code, suggesting restricted access or a takedown state.

Front‑end analysis reveals the use of Vue.js, Axios, Unpkg, Google Analytics, Amazon Web Services components, Amazon CloudFront, and HTTP/3, confirming a modern web stack hosted on AWS‑linked services behind Cloudflare. The page title observed is “BITNEST”, and the domain is catalogued as a Binance brand impersonation attempt. Threat intelligence indicates the domain appears on a single security blocklist, is blocked by PhishDestroy, and has a Gridinsoft trust score of 1 out of 100. An AlienVault OTX pulse references the domain in one indicator set, and VirusTotal reports three detections out of 95 scanning engines.

These findings collectively confirm the malicious intent and elevated risk rating. Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no additional page content has been disclosed. Defenders should add bitnest.me to deny‑list rules, enforce DNS sink‑holing for the associated IP, monitor Cloudflare edge traffic for anomalies, and update endpoint protection signatures to reflect the observed vendor detections. Continuous observation is advised to capture any re‑activation attempts.