# bitcoin-defi-bible.pages.dev — SUSPICIOUS

> Phishing domain bitcoin-defi-bible.pages.dev impersonates Bitcoin, hosted on Cloudflare with SSL via Google Trust Services.

## Summary
Domain bitcoin-defi-bible.pages.dev was identified as an active brand impersonation phishing campaign targeting Bitcoin users. This domain mimics Bitcoin branding to deceive victims into interacting with fraudulent content, likely intended to harvest credentials or cryptocurrency assets. The site leverages Cloudflare Pages for hosting, providing infrastructure-level obfuscation. No drainer kit artifacts were confirmed during initial analysis, but the impersonation strategy aligns with common crypto-draining operations.  

This domain resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc. VirusTotal reports 0 detections out of 95 scanners as of the latest scan, indicating it remains undetected by most security vendors. The SSL certificate is issued by Google Trust Services, enhancing its appearance of legitimacy. The domain is served via Cloudflare Pages, which may complicate direct takedowns. No public blocklist entries were found during initial assessment. Registrar data and creation date were not disclosed in available intelligence.  

Investigation status is currently active with risk level under investigation. Users are advised to avoid accessing this domain and report any related activities to their security teams. The low detection rate suggests a newly deployed or evasive campaign. Remaining risk includes potential user compromise if the page prompts wallet connections or data input. Immediate blocklisting via DNS and browser policies is recommended to mitigate exposure. Further forensic analysis is ongoing to identify infrastructure connections and intended payloads.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/30c5b206-aac0-4aa2-a043-08c756a6a7e5
- PhishDestroy: https://phishdestroy.io/domain/bitcoin-defi-bible.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/bitcoin-defi-bible.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/bitcoin-defi-bible.pages.dev/
Last updated: 2026-03-31