# viptools-es.pages.dev — SUSPICIOUS

> PhishDestroy warns: viptools-es.pages.dev is a crypto drainer scam stealing wallet credentials. 0/95 VirusTotal currently misses this fake login—verify on.

## Summary
PhishDestroy identifies viptools-es.pages.dev as an active crypto-drainer scam currently hosted on Cloudflare Pages.

This domain pretends to be a tool offering “premium” cryptocurrency services and prompts users to connect their wallets via a fraudulent login page. At present the site remains undetected by every VirusTotal vendor (0 detections out of 95), is served from IP 172.66.47.196, and is registered through Cloudflare, Inc.

Despite the Google Trust Services SSL certificate and zero blocklist hits, PhishDestroy confirms the drainer is live and actively harvesting private keys. Users are urged to avoid the domain entirely and verify any similar-looking service against the PhishDestroy database before entering credentials or approving crypto transactions.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.47.196

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/50569d0b-81ea-4abd-a442-dc6cb28a8ee8
- PhishDestroy: https://phishdestroy.io/domain/viptools-es.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/viptools-es.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/viptools-es.pages.dev/
Last updated: 2026-03-24