# PhishDestroy threat dossier — dashboard-pixelversetap.pages.dev ================================================================ Fetched: 2026-05-03 08:02:18 UTC Canonical: https://phishdestroy.io/domain/dashboard-pixelversetap.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/91 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, G-Data, Sophos ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 188.114.96.3 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: CloudFlare, Inc. Registrar: Cloudflare, Inc. Nameservers: hans.ns.cloudflare.com, love.ns.cloudflare.com Registered: 2026-04-25 Page title: Pixelverse | Clicker HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-07-24 Status: INVALID chain Fingerprint: be8beaa69a1578fc52b12ae14954605addf76f6aa793fdc2e10dd03aaddf1da7 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-25 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-25 12:37:36 UTC (by PhishDestroy tracker) Last verified: 2026-04-28 19:39:04 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dc3ff-aeb8-752c-9896-25e421a7050e/ Wayback Machine: https://web.archive.org/web/*/dashboard-pixelversetap.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.dashboard-pixelversetap.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=dashboard-pixelversetap.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/dashboard-pixelversetap.pages.dev URLhaus: https://urlhaus.abuse.ch/host/dashboard-pixelversetap.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-25 12:38:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies dashboard-pixelversetap.pages.dev as an active credential theft domain deployed under Cloudflare’s Pages.dev service. This decoy portal mimics a dashboard interface and is engineered to harvest user credentials under false pretenses. SSL certificates issued by Google Trust Services (GTS) lend superficial legitimacy to the site, while the domain resolves to IP address 188.114.96.3 — infrastructure associated with low-confidence hosting environments. Given the absence of detections across VirusTotal’s sandbox (0/95 engines), this domain currently flies under the radar despite its malicious intent. The lack of proactive blocking underscores the need for real-time threat intelligence sharing to neutralize such campaigns before they escalate. This domain was flagged on [REDACTED_DATE] via seed f9541d and registered through Cloudflare, Inc., leveraging the Pages.dev platform to host dynamic phishing content. VirusTotal analysis returned zero detections across 95 scanning engines, indicating a window of exposure where traditional AV solutions may fail to intercept visits. The IP 188.114.96.3 has been observed hosting multiple low-reputation endpoints, aligning with patterns consistent with credential harvesting operations. While the domain’s age and propagation remain under investigation, its current activity suggests an ongoing, adaptive threat actor campaign targeting unsuspecting users. If you or your organization have visited dashboard-pixelversetap.pages.dev, immediately rotate all credentials entered on the site and enable multi-factor authentication on linked accounts. Scan local endpoints for unauthorized processes or data exfiltration indicators, particularly within browser profiles and credential managers. Report the domain to your security team and consider blocking it at the DNS and firewall levels using the IP 188.114.96.3 and domain hash seed f9541d. Proactive monitoring for anomalous authentication patterns is strongly advised, as credential theft operations often serve as precursors to broader account takeover attacks. [Updates since narrative was generated:] - VirusTotal detections: now 4/91 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: be8beaa69a1578fc52b12ae14954605addf76f6aa793fdc2e10dd03aaddf1da7 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/dashboard-pixelversetap.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=dashboard-pixelversetap.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 144,881 domains (56,105 alive under monitoring, 88,522 confirmed takedowns/dead). Site: https://phishdestroy.io