bitcoin-well-to-koinly[.]pages[.]dev

PhishDestroy identifies bitcoin-well-to-koinly.pages.dev as an active brand impersonation domain targeting Bitcoin with an elevated risk profile. This fraudulent site masquerades as a legitimate cryptocurrency service to deceive users into divulging sensitive wallet credentials or initiating fraudulent transactions. The domain does not represent any official Bitcoin brand, project, or service, and no verifiable affiliation exists with Koinly or Bitcoin-related ecosystems. It is likely leveraging typosquatting and social engineering tactics to exploit trust in established names. This domain was flagged by 1 out of 95 security vendors on VirusTotal, indicating low signature-based detection despite its malicious intent. It is registered through Cloudflare, Inc., resolves to IP address 188.114.96.3, and uses a Google Trust Services SSL certificate. While the exact registration date is not publicly confirmed, its Pages.dev subdomain structure suggests recent creation. It remains unlisted in Google Safe Browsing (GSB) and has not been widely blocklisted, allowing it to evade early detection systems. As of the latest assessment, bitcoin-well-to-koinly.pages.dev remains active and accessible. PhishDestroy recommends immediate network and browser-level blocking of this domain using the IP and domain indicators. Users should exercise extreme caution when encountering links referencing Koinly, Bitcoin, or similar crypto services, especially in unsolicited emails or social media messages. The domain’s low detection ratio and use of reputable infrastructure (Cloudflare, Google Trust) increase its potential to bypass traditional filters, posing a persistent threat to cryptocurrency users seeking portfolio tracking tools. Remaining risk is elevated due to its active status and deceptive branding strategy.