# presale-99bitcoins.pages.dev — SUSPICIOUS

> presale-99bitcoins.pages.dev poses as a Bitcoin presale, tricking users into fake crypto offers. Blocked by Enkrypt & ScamSniffer with 0/95 VirusTotal.

## Summary
PhishDestroy identifies presale-99bitcoins.pages.dev as an active Bitcoin brand impersonation domain designed to deceive users seeking legitimate cryptocurrency opportunities. This malicious site masquerades as a Bitcoin presale initiative, capitalizing on the cryptocurrency’s popularity to lure victims into a fraudulent scheme where deposits would be stolen or credentials harvested. The threat actor leverages social engineering to create false urgency, promising unrealistic returns to coax users into transferring funds or divulging sensitive information. This domain is currently under investigation but remains accessible and operational, representing a clear and present danger to unsuspecting internet users.

Evidence supporting this threat classification includes confirmed detection on at least 2 separate security blocklists, with primary blocks enforced by Enkrypt and ScamSniffer. According to VirusTotal’s latest analysis, the domain shows a concerning 0 out of 95 detection ratio, indicating that mainstream antivirus engines have yet to flag the threat—despite the presence of known security tools already recognizing its malicious nature. The domain resolves to IP address 172.66.46.228 and is registered through Cloudflare, Inc., utilizing a Google Trust Services SSL certificate to enhance its perceived legitimacy. These technical indicators, combined with the impersonation of Bitcoin—a dominant and trusted cryptocurrency brand—paints a clear picture of a sophisticated and evolving operation aimed at exploiting user trust.

Users who have visited presale-99bitcoins.pages.dev should immediately cease any interaction with the site, avoid inputting any personal or financial information, and revoke any credentials that may have been entered. We recommend running a full antivirus scan and clearing browser cache and cookies to remove any persistent tracking. Additionally, users should report the domain to their security provider and consider enabling multi-factor authentication on all crypto-related accounts as a precautionary measure. If funds or sensitive data were submitted, contact the relevant financial institution immediately and file a complaint with local cybercrime authorities. Stay vigilant: impersonation-based scams are increasingly common and often lead to irreversible financial loss.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Bitcoin

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.46.228

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 2 hits
  Lists: ["Enkrypt", "ScamSniffer"]

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/0718ec98-151d-4cb8-bf26-2f32101f059b
- PhishDestroy: https://phishdestroy.io/domain/presale-99bitcoins.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/presale-99bitcoins.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/presale-99bitcoins.pages.dev/
Last updated: 2026-03-26