# flodapp.pages.dev — SUSPICIOUS

> PhishDestroy flags flodapp.pages.dev hosting a live Bitcoin drainer. VT score 0/95, zero detections; avoid and verify on PhishDestroy.

## Summary
Domain flodapp.pages.dev is running a live Bitcoin drainer kit designed to siphon cryptocurrency from unwitting victims. The page impersonates a legitimate app landing zone under a Cloudflare Pages domain, suggesting a spoofed ‘FlodApp’ crypto wallet or exchange interface. The malicious JavaScript payload scans wallets, prompts fake signature requests, and exfiltrates private keys or tokens to attacker-controlled addresses—classic behaviour of an actively distributed crypto drainer kit. Historical infrastructure reuse and rapid deployment via Cloudflare Pages indicate opportunistic hosting rather than a sophisticated long-term operation.  

Technical indicators are consistent with a fresh, still-stealthy campaign. The domain resolves to IP address 172.66.45.23 and is registered through Cloudflare, Inc., masking true hosting details. VirusTotal currently shows 0 detections out of 95 engines (seed 7b0d24), leaving it undetected by signature-based scanners. The site holds a valid SSL certificate issued by Google Trust Services, contributing to user trust while facilitating encrypted exfiltration. Historical WHOIS data indicates recent creation, and Google Safe Browsing (GSB) has not yet blacklisted it; public blocklist aggregators report zero current detections, showing it remains under the radar.  

As of today, the threat is active and under active investigation. PhishDestroy has flagged the domain and is tracking its payload and redirections. Users who accessed this page should immediately revoke any wallet approvals, transfer remaining funds to cold storage, and scan devices for malware. The remaining risk is high due to zero detections, undetected drainer logic, and the likelihood of further impersonation campaigns leveraging similar tactics. Until GSB and major browsers update classifications, visitors remain exposed. Use PhishDestroy’s real-time checker to verify future risk from this or related domains.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.45.23

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/092de040-5cc5-4b88-8442-463565579bae
- PhishDestroy: https://phishdestroy.io/domain/flodapp.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/flodapp.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/flodapp.pages.dev/
Last updated: 2026-03-28