claims-bitcoinhyper-com[.]pages[.]dev

This domain, claims-bitcoinhyper-com.pages.dev, is flagged for brand impersonation targeting Bitcoin under the pretense of a "BTC Hyper Layer 2 Presale." The threat type is classified as brand_impersonation with a high-risk designation due to its deceptive presentation as an official Bitcoin-related project. No explicit drainer kit signatures have been identified, but the domain mimics legitimate cryptocurrency presale pages to likely harvest credentials or funds from unsuspecting users.

Analysis indicates the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.94, located in Canada under Cloudflare's infrastructure. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E8), and the domain was created on March 19, 2026, an anomalous future date suggesting possible manipulation or misconfiguration. Google Safe Browsing status is not explicitly listed, but the domain is actively blocked by at least one security entity.

As of the latest assessment, claims-bitcoinhyper-com.pages.dev remains active and unmitigated. The domain continues to host its deceptive Bitcoin presale page, posing an ongoing risk to users. Recommended response actions include immediate blacklisting of the domain and IP, monitoring for associated infrastructure, and alerting targeted communities about the fraudulent presale. Despite partial detection by security vendors, the domain's persistence and Cloudflare-hosted infrastructure present a residual risk of further exploitation.