yezbitcoin-staking-vforce-demo[.]pages[.]dev

Analysis of yezbitcoin-staking-vforce-demo.pages.dev shows a newly registered domain (creation date April 01, 2026) hosted behind Cloudflare infrastructure and serving content over HTTPS with a Google Trust Services / WE1 certificate. The site returns HTTP 200 and advertises technologies including jQuery, HSTS, Google Hosted Libraries, Cloudflare services, and HTTP/3. The page title observed is "VForrce" and the domain is listed as a brand‑impersonation campaign targeting Bitcoin. Infrastructure indicators reveal the domain resolves to IP 188.114.97.3, a Cloudflare edge node located in Canada, and uses the nameservers davina.ns.cloudflare.com and randall.ns.cloudflare.com. Independent security feeds have flagged the domain; it is blocked by PhishDestroy and appears on one additional blocklist, while a Gridinsoft trust score of 0/100 further underscores its malicious classification. Current status remains active and the threat is under investigation. Defenders should treat the domain as hostile: block DNS resolution and HTTP traffic at perimeter devices, add the fully qualified domain to web filtering and email security policies, and monitor for any derivative domains that combine "bitcoin" with the "vforce" token. Given the use of shared Cloudflare IP space, correlation with other activity should be performed before attributing unrelated traffic to this specific campaign. Continuous threat‑intel updates are advised to capture any evolution of the impersonation technique.