hanveq-solti-biz-pelrox-kentra-sp9ct12[.]pages[.]dev

PhishDestroy has opened an active investigation into hanveq-solti-biz-pelrox-kentra-sp9ct12.pages.dev, a domain currently hosting a crypto drainer impersonating a well-known cryptocurrency service. The threat remains active as of the latest assessment, with no takedown or remediation recorded to date.

This domain was flagged by 17 of 95 VirusTotal vendors, indicating it has not yet been widely detected by automated scanners. It was registered through Cloudflare, Inc., resolves to IP 172.66.44.245, and holds an SSL certificate issued by Google Trust Services. The domain is hosted on Cloudflare Pages, a legitimate platform often abused by threat actors to rapidly deploy phishing infrastructure. Despite its clean detection score, the absence of blocklist entries and low trust metrics suggest this domain is newly operational and actively evolving in its tactics.

Users are strongly advised to avoid interacting with hanveq-solti-biz-pelrox-kentra-sp9ct12.pages.dev and to verify any unsolicited links using PhishDestroy’s real-time scanning tool. Organizations should monitor network traffic for connections to 172.66.44.245 and consider blocking the domain at the DNS level. Given the high risk of financial loss associated with crypto drainers, immediate caution is warranted until further intelligence or remediation actions are confirmed.