decentralizedchain-1v1[.]pages[.]dev

PhishDestroy identifies decentralizedchain-1v1.pages.dev as a recently activated crypto drainer domain, posing significant risks to cryptocurrency users. This domain mimics decentralized finance (DeFi) platforms to trick visitors into connecting wallets or entering credentials, enabling direct fund extraction. The threat actor leverages Cloudflare's infrastructure to host the malicious page, which currently resolves to IP address 188.114.97.3. At the time of analysis, VirusTotal shows 12/95 detections, indicating it remains undetected by most antivirus engines as of this advisory. This domain was flagged through automated threat intelligence pipelines due to its suspicious naming convention ('decentralizedchain-1v1') and association with known cryptocurrency drainer campaigns. Cloudflare, Inc. is the registrar, suggesting an attempt to exploit legitimate hosting services to evade detection. The complete lack of VirusTotal detections highlights the stealthy nature of this operation, making it particularly dangerous for unsuspecting users. While creation and registration details are still under verification, the absence of blocklist entries further underscores its recent emergence. Users who accessed this domain should immediately disconnect any connected wallets, revoke any granted permissions, and scan their devices for malware. If credentials were entered, change passwords immediately and enable two-factor authentication on all related accounts. Report the domain to your security team and consider blocking 188.114.97.3 at the network level. Stay vigilant for unusual transaction confirmations or wallet connection requests from unknown sources.