airdrop-verse-bitcoin-com[.]pages[.]dev

PhishDestroy identifies airdroop-verse-bitcoin-com.pages.dev as an active brand impersonation domain targeting Bitcoin users. The domain is currently under investigation with a risk level classified as active. Brand impersonation remains one of the most prevalent tactics used in crypto-related phishing, aiming to deceive users into transferring funds or surrendering credentials under false pretenses. This domain exhibits multiple red flags consistent with malicious infrastructure. VirusTotal analysis returns 0 detections out of 95 engines as of the last check, indicating low detection coverage despite clear impersonation intent. The domain resolves to IP address 172.66.47.186, a Cloudflare-operated subnet commonly abused for masking hostile origin servers. Registration is facilitated through Cloudflare, Inc., which provides anonymity and evasion for threat actors. The domain carries a Google Trust Services SSL certificate, increasing visual credibility and reducing user suspicion. While full creation date details are not provided, the use of a Cloudflare Workers subdomain (pages.dev) suggests recent or rapid deployment—typical of opportunistic phishing campaigns. Given the impersonation of Bitcoin—a high-value target—and the lack of AV detection, this domain represents a credible threat to cryptocurrency holders. Users interacting with such pages risk fund loss via fraudulent airdrop claims, wallet drainer scripts, or credential harvesting disguised as legitimate Bitcoin-related services. Immediate mitigation includes blocking the domain at DNS and network levels, disabling access to the IP range 172.66.47.0/24 if feasible, and educating users to verify domains via official Bitcoin channels before engagement. Security teams should monitor for similar Cloudflare Workers-hosted Bitcoin impersonation domains and report to threat intelligence platforms for cross-domain correlation.