portalwormhole[.]pages[.]dev

PhishDestroy has identified portalwormhole.pages.dev as a live crypto drainer site impersonating the Wormhole brand. The domain mimics Wormhole’s official channels to trick users into connecting crypto wallets where funds are then silently drained. This domain was flagged after it registered with Cloudflare on May 9, 2025 and began resolving to IP 172.66.44.171, all while using a Google Trust Services SSL certificate to appear legitimate. This threat is currently under investigation but remains active and undetected by security engines, showing 0 detections on VirusTotal out of 95 engines scanned. The domain leverages Cloudflare’s free hosting service to rapidly deploy phishing pages that bypass traditional defenses. The registration date and hosting choice indicate a short-lived campaign designed to harvest credentials and drain connected wallets before takedown. If you visited portalwormhole.pages.dev, immediately disconnect your wallet, revoke any connected permissions in your wallet settings, and run a malware scan on your device. Never reconnect to any unknown link or site claiming to be Wormhole without verifying it on PhishDestroy. Report any suspicious transactions to your wallet provider and local cybercrime unit immediately.