jhtrejjnnvnvtet[.]pages[.]dev

PhishDestroy identifies jhtrejjnnvnvtet.pages.dev as a live crypto drainer phishing domain under active investigation. The domain poses as a legitimate service to harvest wallet credentials and initiate unauthorized crypto transfers.

Domain intelligence reveals it was registered via Cloudflare, Inc., resolves to 188.114.96.3, and holds a Google Trust Services SSL certificate. The domain shows zero detections from VirusTotal vendors (4/95), lacks inclusion in known blocklists, and maintains neutral trust scores across threat feeds. No historical sinkhole data or takedown reports are currently associated with this infrastructure.

Risk remains undetermined due to absence of detections, but the absence of reputation data and reliance on Cloudflare’s Pages.dev infrastructure create a blind spot for defenders. Given the proximity of recent crypto-draining campaigns leveraging similar tactics, proactive blocking is strongly advised. Users are urged to check this domain against PhishDestroy’s live feed and refrain from clicking or inputting credentials until validated. Security teams should firewall the IP and domain while monitoring for emerging associations with malware or additional infrastructure.