# PhishDestroy threat dossier — rrr1-5o0.pages.dev ================================================================ Fetched: 2026-04-25 08:39:51 UTC Canonical: https://phishdestroy.io/domain/rrr1-5o0.pages.dev/ ## VERDICT ---------------------------------------------------------------- CRITICAL THREAT — DO NOT VISIT Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Impersonation Targeted brand: Pendle ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 6/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, BitDefender, Fortinet, G-Data, Kaspersky, LevelBlue ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 172.66.47.152 (CA, Toronto) ASN: AS13335 Cloudflare, Inc. Hosting org: Cloudflare, Inc. Registrar: Cloudflare, Inc. Nameservers: conrad.ns.cloudflare.com, robin.ns.cloudflare.com Registered: 2026-04-04 Page title: Pendle HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-05-24 Status: INVALID chain Fingerprint: 4264a89994d885435552a99b48789e4b7715e1822fa72672100c0b9197e69a86 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-04 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-04 15:50:11 UTC (by PhishDestroy tracker) Last verified: 2026-04-21 16:12:18 UTC Current status: ACTIVE / observable ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019d587b-1dfa-71df-bbef-22dc896d1cf2/ Wayback Machine: https://web.archive.org/web/*/rrr1-5o0.pages.dev crt.sh CT logs: https://crt.sh/?q=%25.rrr1-5o0.pages.dev Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=rrr1-5o0.pages.dev AlienVault OTX: https://otx.alienvault.com/indicator/domain/rrr1-5o0.pages.dev URLhaus: https://urlhaus.abuse.ch/host/rrr1-5o0.pages.dev/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-04 15:56:09 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy identifies rrr1-5o0.pages.dev (seed baec03) as an active generic phishing domain actively pushing a crypto-asset drainer kit. The lure mimics the branding and login flow of a top-tier wallet service to trick users into authorizing malicious token transfers via a web3 interaction popup. No specific wallet brand is named in the observed payload, indicating a generic but high-impact drainer designed to harvest private keys and seed phrases through deceptive authorization requests. Technical indicators point to a recently registered domain hosted on Cloudflare Pages. VirusTotal shows zero detections (0/95 engines) despite the domain resolving to 172.66.47.152 via Cloudflare’s infrastructure. The SSL certificate is issued by Google Trust Services, a common practice among threat actors leveraging legitimate issuers to bypass network filters. WHOIS data reveals Cloudflare, Inc. as the registrar, with the domain created within the last 30 days, confirming its ephemeral nature. At the time of analysis, the domain remains unlisted on major blocklists and maintains a clean Google Safe Browsing (GSB) status, enabling it to evade initial detection layers. Current status is active with an under-investigation risk rating. PhishDestroy has flagged the domain and deployed countermeasures through its real-time blocklist, but the combination of zero AV detections, clean GSB status, and Cloudflare hosting prolongs exposure risk. Users should immediately block traffic to 172.66.47.152 and inspect any recent web3 authorization requests linked to rrr1-5o0.pages.dev. Remaining risk is moderate due to unflagged status but mitigated by proactive threat intelligence feeds and browser extension rules. Immediate verification via PhishDestroy’s lookup tool is strongly recommended before any further interaction. [Updates since narrative was generated:] - VirusTotal detections: now 6/94 (narrative was written when count was lower) ## EVIDENCE HASHES ---------------------------------------------------------------- Favicon MD5: 9dccc90c4ed16d43171f8591faf4e697 TLS cert SHA-256: 4264a89994d885435552a99b48789e4b7715e1822fa72672100c0b9197e69a86 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/rrr1-5o0.pages.dev/ JSON API: https://api.destroy.tools/v1/check?domain=rrr1-5o0.pages.dev Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io