purplebitcoin[.]pages[.]dev

The domain purplebitcoin.pages.dev is currently flagged as a high-risk brand impersonation threat targeting Bitcoin. Analysis confirms active status, with the page title explicitly referencing "Purple Bitcoin ($PBTC) | Bitcoin Reimagined in Purple," indicating an attempt to deceive users by mimicking the legitimate Bitcoin brand. This domain is categorized under brand_impersonation, a tactic frequently employed to exploit trust in established cryptocurrency names for fraudulent purposes.

Technical indicators reveal the domain was registered through Cloudflare, Inc. on May 20, 2026, and resolves to the IP address 172.66.45.17, located in Canada under Cloudflare’s infrastructure. It appears on one security blocklist and is flagged by 1 of 95 vendors on VirusTotal, suggesting limited but confirmed detection. The SSL certificate is issued by Let’s Encrypt (serial number E7), a common but not inherently malicious provider, though its use in this context aligns with typical phishing domain patterns. The domain’s creation date is anomalous, predating the current year, which may indicate an attempt to evade temporal detection heuristics.

Current status remains active, posing a continued risk to users who may mistake it for a legitimate Bitcoin-related service. Recommended actions include blocking the domain at the network level, adding it to internal threat intelligence feeds, and alerting end-users to the impersonation risk. Organizations should monitor for related domains leveraging similar naming conventions or Cloudflare-hosted infrastructure. Cryptocurrency users are advised to verify official channels directly and avoid interacting with unsolicited or unofficial Bitcoin-branded pages.