Search results are sending people to fake Bitrefill checkouts

This report details a coordinated scam campaign that clones Bitrefill’s checkout pages to trick victims into sending cryptocurrency to attacker-controlled addresses; the fake sites are promoted via search results, use visually deceptive and internationalized (Punycode) domains, and are operated like commercial funnels (analytics, timers, checkout UX). The article includes indicators of compromise (a list of malicious domains), explains why the scam is successful and irreversible in most cases, and provides user mitigation advice such as using bookmarks, checking domains carefully, and reporting incidents.