cloud-bitgets-lgn-eng[.]pages[.]dev

This domain, cloud-bitgets-lgn-eng.pages.dev, presents a targeted credential theft threat by impersonating the official Bitget cryptocurrency exchange login portal. The page title, 'Bitgets Login – Secure Cryptocurrency Trading Made,' closely mimics legitimate branding to deceive users into entering account credentials, which are then harvested by threat actors. The domain specifically targets users of the Bitget platform, a known cryptocurrency trading service, increasing the likelihood of successful compromise due to the platform's large user base and the high value of stolen crypto assets. Analysis indicates the domain was registered through Cloudflare, Inc. on April 18, 2026, and currently resolves to the IP address 172.66.46.225. Despite its malicious intent, the domain has not yet been widely flagged, with only 0 out of 95 security vendors on VirusTotal detecting it as malicious. However, it appears on one security blocklist and has been assigned a trust score of 0/100 by Gridinsoft. The domain employs security technologies such as HSTS and HTTP/3, alongside a valid SSL certificate issued by Google Trust Services, which may lend an air of legitimacy to unsuspecting users. Users who have visited cloud-bitgets-lgn-eng.pages.dev or entered credentials on the site should immediately take corrective action. First, change passwords for the Bitget account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication (MFA) on all accounts to mitigate the risk of unauthorized access. Monitor the Bitget account for suspicious transactions, such as unauthorized withdrawals or trades, and report any anomalies to the platform's support team. Additionally, consider revoking active sessions and reviewing connected devices or applications linked to the account. If financial loss is suspected, report the incident to relevant authorities and the targeted platform for further investigation.