# PhishDestroy threat dossier — melegafinance.pages.dev ================================================================ Fetched: 2026-04-25 15:01:46 UTC Canonical: https://phishdestroy.io/domain/melegafinance.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 82/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/94 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Fortinet, G-Data, Webroot ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.45.14 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: melissa.ns.cloudflare.com, micah.ns.cloudflare.com Registered: 2026-04-17 Page title: DebbugDappNode HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E7 Expires: 2026-06-24 Status: INVALID chain Fingerprint: bb076aa0d0fcbfc6ebfaecb593cb10ba4d06dbe0a3fd04e9872c600202bc9e21 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-18 00:38:05 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:10:10 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d9d60-6217-72e1-b18f-a7497b3b2eef/ Wayback Machine: https://web.archive.org/web/*/melegafinance.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.melegafinance.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=melegafinance.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/melegafinance.pages.dev URLhaus: https://urlhaus.abuse.ch/host/melegafinance.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-18 00:38:36 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy has identified a crypto drainer operating at melegafinance.pages.dev under the Cloudflare Pages platform. This fraudulent site poses as a legitimate finance portal but is engineered to siphon cryptocurrency from unsuspecting users. It employs deceptive branding—likely mimicking a trusted platform—to trick visitors into connecting their digital wallets, whereupon malicious scripts execute unauthorized transfers of tokens and NFTs to attacker-controlled addresses. The domain leverages Cloudflare’s infrastructure for speed and anonymity, making it harder for traditional blocking tools to flag in real time. Users who interact with the site risk immediate financial loss, with stolen assets typically routed through mixers or exchanged for privacy coins, reducing the chances of recovery. This domain was flagged by PhishDestroy’s automated pipeline within hours of domain registration. Intelligence confirms it was registered through Cloudflare, Inc., currently shows 0 out of 95 VirusTotal detections (as of the latest scan), and is secured by a Let’s Encrypt SSL certificate. The site resolves to IP 172.66.45.14, a Cloudflare edge node commonly used in phishing and malware campaigns. The lack of detections highlights the importance of proactive threat intelligence—many AV engines rely on signatures that are slow to evolve, while phishing kits frequently update to evade detection. The domain is still active and under active monitoring by PhishDestroy. If you visited melegafinance.pages.dev or entered any wallet or financial information, take immediate action. Disconnect your wallet from any active sessions, revoke any suspicious token approvals via tools like revoke.cash, and transfer remaining funds to a clean wallet. Enable hardware wallet authentication and multi-factor authentication wherever possible. Report the domain to PhishDestroy for investigation—your submission helps protect the broader community. Never trust unsolicited links or offers promising unrealistic returns. Always verify URLs and use trusted sources like PhishDestroy’s threat database before interacting with financial platforms. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: bb076aa0d0fcbfc6ebfaecb593cb10ba4d06dbe0a3fd04e9872c600202bc9e21 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/melegafinance.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=melegafinance.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io