protolcolnode[.]pages[.]dev

PhishDestroy identifies protolcolnode.pages.dev as an active fake protocol node phishing scam designed to steal cryptocurrency wallet credentials and assets. The domain mimics legitimate protocol node services to deceive users into connecting wallets or entering sensitive data. This threat is classified as a credential harvesting and cryptocurrency theft operation currently operating under investigation status.

This domain was flagged by 1 of 95 VirusTotal vendors as of the latest scan, operates under Cloudflare, Inc., and resolves to IP address 172.66.45.14. The SSL certificate is issued by Google Trust Services, indicating a facade of legitimacy. However, the absence of detections and active threat status suggest this scam may still be in early deployment stages. No blocklist entries or trust score data are available at this time, raising concerns about its rapid evolution.

PhishDestroy currently classifies protolcolnode.pages.dev as an active threat requiring immediate user caution. Users are strongly advised to avoid accessing this domain or any linked pages. If interaction has occurred, disconnect wallets, revoke any permissions granted, and run a full security scan. Report the domain to your antivirus provider and relevant cybersecurity authorities. Monitor wallet activity closely and consider transferring assets to a secure, offline wallet until the threat is neutralized.