bitbotclaim-2ip[.]pages[.]dev

The domain bitbotclaim-2ip.pages.dev is currently active and involved in a fake airdrop scam. Despite having zero detections on VirusTotal, this domain is already listed on one public blocklist, specifically PhishDestroy's. This early detection highlights the domain's freshness and the typical 24-72 hour window during which phishing domains operate before being flagged by antivirus databases.

Registered through Cloudflare Pages, bitbotclaim-2ip.pages.dev masquerades as Bitbot, claiming to be the world’s first Telegram self-custodial trading bot. Such scams often lure victims with promises of free cryptocurrency, leveraging the popularity of airdrops in the crypto community. The domain's SSL certificate is issued by Google Trust Services, and it is hosted on an IP address associated with CloudFlare, Inc., located in Canada.

Phishing domains like this exploit the gap between domain registration and antivirus database updates. PhishDestroy's proactive detection pipeline captures these threats in their nascent stages, providing crucial early warnings. The lack of VirusTotal detections should not be seen as an indication of safety but rather as evidence of the domain's recent creation and activity. As the domain continues to operate, it poses a risk to unsuspecting users who may be drawn in by the allure of a fake airdrop, underscoring the importance of early threat intelligence.