presale-99bitcoins[.]pages[.]dev

Analysis of presale-99bitcoins.pages.dev indicates an active high‑risk brand‑impersonation campaign targeting the Bitcoin community. The domain was registered on 2026-03-26 through Cloudflare, Inc., and resolves to the Cloudflare IP 172.66.46.228 located in Canada. Both authoritative nameservers (april.ns.cloudflare.com, damien.ns.cloudflare.com) are Cloudflare‑managed, suggesting the attacker is leveraging the provider’s infrastructure for anonymity and resilience. The site serves HTTP 200 responses and presents a TLS certificate issued by Google Trust Services under the WE1 authority, confirming encrypted transport. The page title “99Bitcoins Token Presale: Now Open” aligns with the advertised brand target Bitcoin, reinforcing the classification as brand impersonation. Detected client‑side libraries include YouTube, Unpkg, SweetAlert2, jsDelivr, crypto‑js, as well as Google Tag Manager and Google Analytics, indicating typical third‑party tracking and script loading. HSTS is enabled, and the site uses the Cloudflare CDN. Reputation services flag the domain as malicious: Scamadviser assigns a trust score of 11/100, Gridinsoft scores 0/100, and VirusTotal reports 10 of 94 scanners flagging the domain. It appears on three blocklists (PhishDestroy, ScamSniffer, Enkrypt). The combination of low trust scores, multiple vendor detections, and inclusion on dedicated blocklists confirms malicious intent. Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content beyond the title has been examined. Defenders should block DNS resolution to 172.66.46.228, add the domain to URL filtering policies, and monitor for outbound connections to the listed third‑party services that may be used for data exfiltration. Continuous observation of any new subdomains under the same Cloudflare account is recommended.