# solsagebot.pages.dev — SUSPICIOUS

> PhishDestroy flags solsagebot.pages.dev as an active crypto drainer site with 0/95 VirusTotal detections. Check the full report.

## Summary
PhishDestroy identifies solsagebot.pages.dev operating as a crypto-draining phishing page targeting unsuspecting cryptocurrency users. This Cloudflare Pages domain—solsagebot.pages.dev—employs a dress-as-doctor technique to trick victims into connecting wallets and unwittingly authorizing malicious token transfers. The landing page mirrors legitimate Solana or Solana-based ecosystem interfaces, purporting to offer trading bots or portfolio optimization tools. No known brand impersonation or third-party drainer kit reuse has been confirmed at this stage, suggesting a bespoke attack chain optimized for stealth and speed.  

This domain was flagged by PhishDestroy on September 30, 2024, with a current VirusTotal detection score of 0 out of 95 antivirus engines. It resolves to IP 172.66.47.36 via Cloudflare, Inc., which also serves as the registrar under a *.pages.dev wildcard certificate issued by Google Trust Services on August 16, 2024. The domain remains absent from Google Safe Browsing (GSB) and public blocklists as of this report, indicating a recently deployed threat infrastructure operating below detection thresholds.  

The site remains active and continues to evolve, with no takedown actions observed. While the immediate risk is classified as "under investigation," the lack of blacklist coverage increases exposure to end-users. PhishDestroy recommends blocking IP 172.66.47.36 and the domain solsagebot.pages.dev at the network perimeter. Users are urged to verify URLs via official channels, avoid clicking unsolicited links, and inspect any wallet connection requests for unauthorized transaction approvals. Blockchain communities and security teams are advised to monitor this domain for emergent IOCs and update defenses accordingly.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.36

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/921b109b-9420-42d1-b6f3-f2e6937f7420
- PhishDestroy: https://phishdestroy.io/domain/solsagebot.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/solsagebot.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/solsagebot.pages.dev/
Last updated: 2026-03-22