# normandiebitcoin.com — SUSPICIOUS

> normandiebitcoin.com impersonates Bitcoin to deceive users. Flagged by 0 of 95 VirusTotal vendors, it poses phishing risks.

## Summary
normandiebitcoin.com is a domain actively engaged in Bitcoin brand impersonation, currently under investigation for malicious intent. The domain directly mimics the Bitcoin brand, exploiting user trust to facilitate fraudulent activities such as phishing, scam transactions, or credential harvesting. As of the latest assessment, this domain remains active and is being scrutinized for its potential role in cyber threats targeting cryptocurrency users.  

This domain was flagged by 0 of 95 VirusTotal vendors as of the investigation seed 7dbe2d, indicating it has not yet been widely recognized as malicious despite its suspicious characteristics. It was registered on April 30, 2023, through Porkbun LLC, a domain registrar known for low-cost services with minimal identity verification requirements. The domain resolves to the IP address 44.230.85.241 and operates with a Let's Encrypt SSL certificate, both of which are commonly exploited tactics to lend false legitimacy to fraudulent sites. Additionally, this domain has not been identified on any public blocklists as of this report, further highlighting the stealthy nature of its operation.  

Given the active status and high-risk potential of this domain, immediate caution is advised for cryptocurrency users and enterprises in the blockchain sector. Users should avoid engaging with normandiebitcoin.com or any associated services until further investigations confirm its legitimacy. Security teams are recommended to block the domain and IP address at the network level, update threat intelligence feeds, and conduct user awareness campaigns to mitigate exposure. Additionally, reporting this domain to domain registrars, law enforcement, and threat intelligence platforms like VirusTotal can expedite its flagging and removal. Continuous monitoring for newly emerging indicators of compromise (IOCs) is advised to prevent potential fallout from this fraudulent activity.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registered: 2023-04-30 15:57:23
- Registrar: Porkbun LLC
- IP: 44.230.85.241

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/44939b2a-aea5-472f-b8d2-f496bb4a8e4c
- PhishDestroy: https://phishdestroy.io/domain/normandiebitcoin.com/
- LLM endpoint: https://phishdestroy.io/domain/normandiebitcoin.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/normandiebitcoin.com/
Last updated: 2026-04-01