khoiphucvibitcoin-com[.]pages[.]dev

Domain khoiphucvibitcoin-com.pages.dev has been identified as a brand impersonation site specifically targeting Bitcoin users. The site remains active and is currently under investigation by the SOC team. The domain leverages a visually similar name to Bitcoin services in an attempt to deceive victims into engaging with it under false pretenses.

This domain was flagged by zero of 95 VirusTotal vendors at the time of discovery, indicating it has not yet been widely recognized as malicious. It was registered through Cloudflare, Inc., resolving to IP 172.66.44.81 with an SSL certificate issued by Google Trust Services. The page title, which includes Vietnamese language elements, suggests a regional targeting strategy focused on Vietnamese-speaking users seeking Bitcoin wallet recovery services. Current threat intelligence points to the domain’s active status with no observed takedown or blocklisting as of this report.

Given the unflagged status and use of trusted infrastructure (Cloudflare, Google Trust Services), the risk of successful user deception remains elevated. Organizations should immediately block access to this domain at the network perimeter and alert users, particularly those involved in cryptocurrency transactions, to avoid interaction. Continuous monitoring is advised due to the potential for rapid evolution in impersonation tactics. Additionally, defenders should update blocklists and perform retrospective analysis on historical DNS resolutions involving this IP or similar domains.