verify-bitcoinhelp[.]pages[.]dev

The domain verify-bitcoinhelp.pages.dev is currently active and engaged in brand impersonation targeting Bitcoin. Analysis indicates the site mimics a verification portal, as evidenced by its page title, 'Verify | bitcoinhelp.ca,' suggesting an attempt to deceive users into believing they are interacting with a legitimate Bitcoin support or verification service. The domain’s infrastructure and content are designed to exploit trust in the Bitcoin brand, potentially for fraudulent purposes such as credential harvesting or cryptocurrency theft. Infrastructure analysis reveals the domain was registered on May 02, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3, located in Canada. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. Security vendor detection is minimal but notable: 1 of 95 VirusTotal vendors flag the domain as malicious. The domain appears on one security blocklist and is actively blocked by PhishDestroy. The low detection rate may indicate either a newly deployed campaign or evasion techniques to avoid broader scrutiny. As of the latest assessment, verify-bitcoinhelp.pages.dev remains active and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and include it in endpoint protection rules. Users should be educated to recognize impersonation tactics, particularly those involving cryptocurrency-related services. Monitoring for additional domains resolving to the same IP or using similar naming conventions is recommended to identify potential related threats. Immediate reporting to relevant security communities and brand protection teams is encouraged to mitigate further exposure.