# airdrop-verse-bitcoin-com.pages.dev — SUSPICIOUS

> airdroop-verse-bitcoin-com.pages.dev is a brand impersonation domain with 0/95 VirusTotal detections targeting Bitcoin users. Immediate action required.

## Summary
PhishDestroy identifies airdroop-verse-bitcoin-com.pages.dev as an active brand impersonation domain targeting Bitcoin users. The domain is currently under investigation with a risk level classified as active. Brand impersonation remains one of the most prevalent tactics used in crypto-related phishing, aiming to deceive users into transferring funds or surrendering credentials under false pretenses.  This domain exhibits multiple red flags consistent with malicious infrastructure. VirusTotal analysis returns 0 detections out of 95 engines as of the last check, indicating low detection coverage despite clear impersonation intent. The domain resolves to IP address 172.66.47.186, a Cloudflare-operated subnet commonly abused for masking hostile origin servers. Registration is facilitated through Cloudflare, Inc., which provides anonymity and evasion for threat actors. The domain carries a Google Trust Services SSL certificate, increasing visual credibility and reducing user suspicion. While full creation date details are not provided, the use of a Cloudflare Workers subdomain (pages.dev) suggests recent or rapid deployment—typical of opportunistic phishing campaigns.  Given the impersonation of Bitcoin—a high-value target—and the lack of AV detection, this domain represents a credible threat to cryptocurrency holders. Users interacting with such pages risk fund loss via fraudulent airdrop claims, wallet drainer scripts, or credential harvesting disguised as legitimate Bitcoin-related services. Immediate mitigation includes blocking the domain at DNS and network levels, disabling access to the IP range 172.66.47.0/24 if feasible, and educating users to verify domains via official Bitcoin channels before engagement. Security teams should monitor for similar Cloudflare Workers-hosted Bitcoin impersonation domains and report to threat intelligence platforms for cross-domain correlation.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.186

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/cc25341a-0c84-4cbc-b1e3-da04283e5b6f
- PhishDestroy: https://phishdestroy.io/domain/airdrop-verse-bitcoin-com.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/airdrop-verse-bitcoin-com.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/airdrop-verse-bitcoin-com.pages.dev/
Last updated: 2026-03-26