# nodehub.pages.dev — SUSPICIOUS

> nodehub.pages.dev operates as a crypto drainer scam with 1 flag on VirusTotal. Immediate blocking is advised to prevent cryptocurrency theft.

## Summary
nodehub.pages.dev has been confirmed as an active crypto drainer phishing site. The threat level is elevated due to its live status and designed purpose to deceive users into unknowingly approving malicious transactions that drain cryptocurrency wallets. This is not generic phishing; it specifically targets blockchain assets by impersonating legitimate services or platforms under the guise of NodeHub, a purported blockchain-related service or tool.

This domain was flagged by PhishDestroy with the following indicators: 1 out of 95 security vendors on VirusTotal (1/95) flagged the domain as malicious. The domain is registered through Cloudflare, Inc., resolving to IP address 172.66.44.96, which is associated with Cloudflare’s infrastructure. The SSL certificate is issued by Google Trust Services, adding false legitimacy to the site. While creation date and blocklist participation were not explicitly provided, the presence of a single VirusTotal detection suggests low coverage but active abuse. The low detection rate may be attributed to the novelty or targeted nature of the campaign.

Mitigation begins with immediate blocking of nodehub.pages.dev and 172.66.44.96 at the network or endpoint level. Users should avoid interacting with any page under this domain or subdomains. For organizations, implement DNS filtering or endpoint protection that blocks crypto drainer domains and monitor for outbound cryptocurrency-related transactions to unknown addresses. If compromised, users should revoke malicious wallet approvals via tools like revoke.cash and transfer remaining assets to a new wallet. Never approve unsolicited transactions or connect wallets to unfamiliar dApps. Report the domain to phishing abuse channels including Google Safe Browsing, Cloudflare Abuse, and relevant blockchain security platforms.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.96

## Detection Status
- VirusTotal: 1 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/2628d044-04e8-4107-a2d3-26b825cee2e1
- PhishDestroy: https://phishdestroy.io/domain/nodehub.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/nodehub.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/nodehub.pages.dev/
Last updated: 2026-03-22