pocketchange-2oh[.]pages[.]dev

PhishDestroy identifies pocketchange-2oh.pages.dev as an active crypto drainer phishing domain designed to trick cryptocurrency holders into connecting their wallets and approving malicious token transfer permissions. This domain was flagged as a generic phishing page with zero detections on VirusTotal out of 95 engines, indicating it currently evades mainstream antivirus signatures. The site resolves to IP 172.66.47.142 and operates under Cloudflare’s pages.dev subdomain platform, using a Google Trust Services SSL certificate to appear legitimate. Registrar records show recent creation through Cloudflare, Inc., suggesting the threat actor rapidly deployed this domain to capitalize on trending cryptocurrency campaigns. If you visited pocketchange-2oh.pages.dev, immediately revoke any wallet connections through your wallet’s interface or Etherscan token approvals page. Do not approve transactions you did not initiate. Run a malware scan using reputable tools like Malwarebytes or Windows Defender. Report the domain to PhishDestroy for further analysis and warn others in crypto communities. Always verify URLs via PhishDestroy before entering wallet details or clicking links from unsolicited messages.