# bitcoincashsite-www.pages.dev — SUSPICIOUS

> bitcoincashsite-www.pages.dev impersonates Bitcoin brands using Cloudflare Pages. Hosted at 172.66.44.169, it remains undetected (0/95 VirusTotal).

## Summary
Domain bitcoincashsite-www.pages.dev has been identified by PhishDestroy as an active brand impersonation scam targeting Bitcoin users. The site abuses Cloudflare Pages hosting to mimic Bitcoin-related content, attempting to deceive visitors into disclosing sensitive credentials or cryptocurrency assets. No advanced drainer kit signatures—such as FakeReward or AngelDrainer—were observed in initial triage, suggesting a lightweight social-engineering operation with likely links to low-sophistication fraudster collectives focused on quick monetization through scam wallets or credential harvesting forms.  

This domain resolves to IP 172.66.44.169 via Cloudflare, Inc., leveraging Google Trust Services for SSL. According to VirusTotal aggregations, the site remains undetected with a clean score of 0/95 at the time of reporting. Further technical indicators include registration through Cloudflare’s platform, which obscures registrant details and complicates attribution, and the use of Google Trust Services certificates—a tactic increasingly adopted by threat actors to build legitimacy. Blocklist presence is currently negligible, indicating rapid deployment and limited prior exposure. Creation date remains unverified due to Cloudflare masking, but active resolution confirms operational status.  

As of this report, bitcoincashsite-www.pages.dev remains active and unblocked across major browsers and security stacks. Although not yet flagged by Safe Browsing, PhishDestroy has flagged the domain and escalated indicators to trusted threat intelligence partners and hosting providers. Users are strongly advised to avoid interacting with this domain, verify all URLs before clicking, and report any suspicious activity involving Bitcoin brand impersonations. The residual risk remains medium due to the site’s ability to evade detection and the growing threat of copycat deployments under similar Cloudflare Pages services. Continuous monitoring is recommended as the campaign may evolve or scale.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.169

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/e3123d38-08ba-4a15-9550-8769488fba02
- PhishDestroy: https://phishdestroy.io/domain/bitcoincashsite-www.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/bitcoincashsite-www.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/bitcoincashsite-www.pages.dev/
Last updated: 2026-03-25