wallet-bitcoin-com[.]pages[.]dev

PhishDestroy has identified wallet-bitcoin-com.pages.dev as a suspected brand impersonation site targeting Bitcoin users. This domain leverages a .pages.dev subdomain to mimic legitimate cryptocurrency services, creating deceptive entry points for potential financial theft. The infrastructure relies on Cloudflare’s Pages platform, which hosts the payload on IP address 172.66.46.216, currently unlisted on majority of threat intelligence feeds. While the SSL certificate issued by Google Trust Services lends superficial credibility, the domain’s intent remains malicious, aimed at deceiving visitors through fraudulent branding and UI replication.

Technical analysis reveals minimal detection coverage, with 0 out of 95 VirusTotal scanners flagging this domain at the time of investigation. The domain was registered through Cloudflare, Inc., a common tactic to obscure registrar-level telemetry. Despite the absence of immediate detections, PhishDestroy assesses this as an active threat due to its clear intent to impersonate a major financial brand. Users should note that the domain shows no presence on major blocklists as of now, reinforcing the need for proactive verification rather than reliance on reactive systems.

Any user who visited wallet-bitcoin-com.pages.dev should immediately cease interaction and verify their accounts for unauthorized transactions or compromised credentials. If you entered sensitive information, such as wallet credentials or private keys, revoke any associated access permissions and transfer remaining assets to a secure wallet. PhishDestroy recommends using our platform to validate the legitimacy of cryptocurrency-related domains before proceeding with any transactions. Exercise extreme caution with pages.dev subdomains linked to financial services, as these are frequently abused for impersonation campaigns.