mainnodes-connect[.]pages[.]dev

PhishDestroy identifies domain mainnodes-connect[.]pages[.]dev as part of an active crypto drainer campaign. This malicious page masquerades as a legitimate node connection service, tricking victims into connecting fraudulent cryptocurrency wallets. Upon interaction, the drainer silently extracts all funds from connected wallets without user consent. Recent scans indicate this domain remains undetected by 95 antivirus engines on VirusTotal and continues to operate without being flagged by major security vendors. The infrastructure relies on Cloudflare’s Pages service for hosting, leveraging Google Trust Services certificates to appear legitimate. This mismatch between zero detections and malicious behavior highlights the sophisticated nature of modern crypto drainers, which often evade detection through legitimate hosting providers and trusted certificates. PhishDestroy’s investigation found this domain resolves to IP address 188.114.96.3, which has been linked to multiple crypto drainer campaigns in recent months. The registrar information confirms Cloudflare, Inc. as the service provider, while the domain itself was created with the intent to impersonate legitimate blockchain services that users frequently access for node operations or wallet management. Technical analysis of mainnodes-connect[.]pages[.]dev reveals several red flags consistent with crypto drainer operations. VirusTotal currently reports zero detections out of 95 security vendors, suggesting this newly registered domain has not yet been widely analyzed by threat intelligence systems. The domain’s registration through Cloudflare’s Pages platform allows threat actors to rapidly deploy and decommission malicious infrastructure, while Google Trust Services certificates provide an additional layer of authenticity to deceive potential victims. The associated IP address 188.114.96.3 has been observed hosting multiple crypto drainer domains in recent threat intelligence reports, further correlating this infrastructure with active malicious campaigns. The domain’s recent creation date, combined with zero detections on VirusTotal, indicates this is a newly deployed threat actively targeting cryptocurrency users. PhishDestroy’s analysis suggests this campaign specifically targets blockchain enthusiasts seeking node connection services, as the domain name implies legitimate functionality within distributed network operations. Users who have visited mainnodes-connect[.]pages[.]dev should immediately disconnect any cryptocurrency wallets and revoke any permissions granted to this domain. Scan all connected devices for wallet-related malware or browser extensions that may have been installed without consent. The domain’s fake login page likely captures wallet connection requests to drain funds, making it imperative to verify any node connection services through official channels. PhishDestroy recommends users conduct a comprehensive security audit of their cryptocurrency holdings and wallet connections, paying particular attention to ERC-20 token approvals and DeFi protocol interactions. Report any suspicious transactions or unauthorized fund movements to relevant blockchain explorers and local cybersecurity authorities. Consider rotating wallet addresses and private keys if any interaction with this domain occurred, as crypto drainers often maintain persistence through malicious browser storage or wallet extension modifications. Stay vigilant for future iterations of this campaign, as threat actors frequently modify domain names and hosting infrastructure to evade detection while maintaining operational effectiveness.