port3-ct86[.]pages[.]dev

PhishDestroy has identified port3-ct86[.]pages[.]dev as an active crypto drainer domain under investigation. This site poses a significant risk to cryptocurrency users by employing deceptive tactics to trick victims into connecting wallet extensions and authorizing malicious transactions, resulting in direct fund theft. The domain leverages Cloudflare Pages for hosting, providing anonymity and evasion capabilities, while resolving to IP 188.114.96.3. Using a Google Trust Services SSL certificate, it mimics legitimate services to gain user trust before executing its payload. At this time, VirusTotal shows 0 detections out of 95 security vendors, leaving it undetected by most antivirus systems. This domain is currently unlisted on major blocklists including Google Safe Browsing, PhishTank, and OpenPhish, allowing it to remain active and operational. The threat actor registered this domain through Cloudflare, Inc., providing additional cloaking through Cloudflare Pages, a legitimate platform abused for malicious purposes. This combination of low detection rates, high anonymity infrastructure, and active evasion tactics places this domain in PhishDestroy’s high-risk category, requiring immediate user vigilance and potential blacklist escalation.

Technical indicators further confirm the malicious intent of port3-ct86[.]pages[.]dev. The domain resolves to IP 188.114.96.3, hosted on Cloudflare’s network, a common technique to obscure the true origin and infrastructure of malicious sites. Despite the use of a Google Trust Services SSL certificate, which typically inspires user confidence, this domain lacks any legitimate business registration or verifiable credibility. VirusTotal’s 0/95 detection rate underscores its ability to evade current security measures, while its absence from major blocklists indicates a timing delay in threat intelligence dissemination. The Cloudflare Pages platform, while legitimate, has increasingly become a vector for cybercriminals distributing malware, phishing kits, and crypto drainers due to its speed, scalability, and anonymity features. This domain exemplifies advanced adversary tactics, combining infrastructure abuse, SSL spoofing, and delayed detection to maximize victim compromise. Users encountering this domain are strongly advised to treat it as hostile and refrain from any interaction.

PhishDestroy recommends urgent mitigation steps to neutralize the threat posed by port3-ct86[.]pages[.]dev. Users must avoid accessing this domain under any circumstances and should report it to their browser provider, security vendor, or through PhishDestroy’s reporting portal. Organizations should add the domain and IP 188.114.96.3 to their network blocklists immediately to prevent access from internal systems. Web developers and platform providers such as Cloudflare should review this domain for policy violations under their acceptable use guidelines. Cryptocurrency users are urged to verify all wallet connection requests via hardware wallet verification or trusted interface checks before authorizing any transaction. Since this domain currently remains undetected by mainstream antivirus systems, proactive blocklisting and threat intelligence sharing are critical to prevent further victimization. Continuous monitoring and immediate action are necessary to mitigate the risk of crypto fund theft facilitated by this active drainer domain.