# greenbitcoin-xyz-en.pages.dev — SUSPICIOUS

> PhishDestroy investigates greenbitcoin-xyz-en.pages.dev, a Bitcoin brand impersonation phishing site flagged by 1 of 95 VirusTotal vendors.

## Summary
PhishDestroy identifies greenbitcoin-xyz-en.pages.dev as an active Bitcoin brand impersonation phishing domain engaged in deceptive cryptocurrency-related fraud. This domain is currently operational and leverages visual and textual elements to mimic official Bitcoin branding, aiming to deceive users into disclosing sensitive information or transferring funds under false pretenses. The threat actor behind this domain is exploiting the trust associated with Bitcoin to manipulate victims into engaging with fraudulent services or credentials entry points. The operation remains active as of the latest intelligence, with indicators suggesting ongoing victim targeting through impersonation tactics.  This domain was flagged by 1 of 95 VirusTotal security vendors, indicating limited but confirmed malicious detection. It is registered through Cloudflare, Inc. and resolves to IP address 172.66.46.249. The domain appears on 2 separate security blocklists and holds an SSL certificate issued by Google Trust Services, which may contribute to a false sense of legitimacy. While the infrastructure appears partially cloaked behind Cloudflare’s services, the presence of a trusted SSL issuer and regional hosting does not mitigate the inherent deceptive intent of the domain’s design and purpose.  Users and organizations are advised to immediately block access to greenbitcoin-xyz-en.pages.dev and investigate any recent interactions with similar domains. Security teams should monitor network traffic for connections to the identified IP (172.66.46.249) and scan endpoints for signs of credential harvesting or cryptocurrency wallet compromise. It is strongly recommended to report this domain to relevant threat intelligence platforms and browser security teams to enhance collective defense. Avoid engagement with any content resembling Bitcoin branding hosted on unverified or non-official domains.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.249

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/9d30e998-775a-473a-86c1-26c051dff75a
- PhishDestroy: https://phishdestroy.io/domain/greenbitcoin-xyz-en.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/greenbitcoin-xyz-en.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/greenbitcoin-xyz-en.pages.dev/
Last updated: 2026-03-21