bitcoindogeclaim[.]pages[.]dev

Analysis of bitcoindogeclaim.pages.dev shows a high‑risk brand‑impersonation campaign targeting Telegram users. The domain was registered on February 21, 2026 and is serviced by Cloudflare, Inc., using the authoritative nameservers oaklyn.ns.cloudflare.com and dale.ns.cloudflare.com. DNS resolution points to IP address 188.114.96.3, which belongs to the Cloudflare network (AS13335) and is geolocated in the United States. HTTPS is provided by a Google Trust Services certificate (WE1) and the server advertises HSTS and HTTP/3, indicating a modern TLS configuration. An HTTP request to the site returned a 403 status code, and the page title observed during the brief capture was "Bitcoin Dogs - The First Ever ICO on the Bitcoin Blockchain," a title unrelated to the Telegram brand but consistent with a cryptocurrency lure.

Reputation services rate the domain extremely poorly: Scamadviser assigns a trust score of 1 / 100, Gridinsoft 0 / 100, and Google Safe Browsing flags the URL for social engineering. The domain appears on three independent blocklists—PhishDestroy, ScamSniffer, and Enkrypt—and is listed as offline at the time of this report. VirusTotal recorded eight detections out of ninety‑three scanning engines, reinforcing the malicious classification. The observed indicators collectively confirm a wallet/seed phishing operation that attempts to harvest Telegram credentials or seed phrases under the guise of a crypto ICO.

Uncertainty remains regarding the exact phishing page content, as the site returned a 403 response and was taken offline before full content capture could be performed. No additional infrastructure such as secondary C2 hosts or malware payloads has been identified. Defenders should block the domain and associated IP address at network perimeter devices, update URL filtering feeds with the listed blocklist entries, and monitor for any outbound connections to Cloudflare edge nodes that may be used for future payload delivery.