claim99bitcoins[.]pages[.]dev

The domain claim99bitcoins.pages.dev was registered on February 21, 2026 through Cloudflare, Inc. and resolves to the IP address 172.66.47.53, which belongs to AS13335 Cloudflare, Inc. in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 identifier, indicating that HTTPS is enabled but does not provide any assurance of legitimacy. An HTTP request returns a 403 status code and the page title returned by the server is "Suspected phishing site | Cloudflare," which aligns with the classification of a brand‑impersonation campaign targeting Bitcoin users. Infrastructure analysis shows the presence of HSTS, Cloudflare and HTTP/3 technologies, consistent with the hosting provider’s default configuration.

The domain appears on four independent blocklists—PhishDestroy, Polkadot, Enkrypt, and Codeesura—and is listed on four security blocklists overall. Gridinsoft assigns a trust score of 0 out of 100, reflecting extreme suspicion. VirusTotal analysis records three positive detections out of ninety‑three scanning engines, reinforcing the malicious assessment. The risk level is marked elevated, and the current operational status is offline, indicating that the site has been taken down or otherwise rendered inaccessible.

Defenders should continue to block the domain and its associated IP address at perimeter firewalls, DNS resolvers, and endpoint protection solutions. Ongoing monitoring of the domain’s DNS records is recommended because Cloudflare‑hosted domains can be re‑activated or re‑pointed quickly. Adding the domain to internal threat intel feeds and sharing the indicator with partner ISPs will help prevent future impersonation attempts. Because the only visible artifact is the page title, no further content analysis is available; investigators should treat any future re‑appearance of the domain with heightened scrutiny and apply the same mitigation controls.