# bitmine.pages.dev — SUSPICIOUS

> bitmine.pages.dev is a cryptocurrency phishing page flagged by 0 VirusTotal vendors, stealing credentials through Cloudflare.

## Summary
PhishDestroy identifies active cryptocurrency credential theft operations on bitmine.pages.dev, a fraudulent page hosted via Cloudflare Pages, currently under investigation.

This domain was flagged by 0 of 95 VirusTotal vendors as of c9cafd, registered through Cloudflare, Inc. with an SSL certificate from Google Trust Services. The page resolves to IP 172.66.44.185 via Cloudflare’s proxy infrastructure, a technique commonly used to disguise origin servers and evade detection.

System administrators should immediately block bitmine.pages.dev at the network perimeter while users avoid interactions entirely. Monitor for connected wallets or exchange accounts for unauthorized access attempts, as this campaign likely targets cryptocurrency holders under the guise of mining operations. Due to low initial detection rates and Cloudflare-backed infrastructure, this threat requires heightened scrutiny — verify any mining-related communications through official channels before engaging.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.185

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/a1c92b95-741e-491d-9169-81ee674ff3a0
- PhishDestroy: https://phishdestroy.io/domain/bitmine.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/bitmine.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/bitmine.pages.dev/
Last updated: 2026-03-22