d6c32bb2[.]sw-2xn[.]pages[.]dev

PhishDestroy identifies d6c32bb2.sw-2xn.pages.dev as an active crypto-draining phishing domain hosted on Cloudflare Pages that attempts to trick visitors into connecting wallets and signing malicious transactions. The infrastructure is configured to impersonate legitimate decentralized applications (dApps) and prompt users to approve token-transfer permissions, after which funds are drained directly from connected wallets. No specific brand logo or spoofed domain was observed in static analysis, indicating the threat actor is using a generic drainer kit that adapts to any popular token or network context.

Technical indicators show that the domain resolves to IP 172.66.44.227 and is served via a Let’s Encrypt SSL certificate (CN = sni.cloudflaressl.com). VirusTotal records 5 out of 95 security vendors flagging the URL as malicious as of seed 16b5c4. The domain is registered through Cloudflare, Inc., which provides both hosting and DNS resolution, and there is no evidence of prior Google Safe Browsing (GSB) classification. Current threat intelligence from multiple feeds lists this domain on 3 blocklists, confirming its elevated risk profile.

This domain remains active and poses a high risk to cryptocurrency users who may interact with it under the false impression of a legitimate service. PhishDestroy recommends immediate network-wide blocking of both the domain and its underlying IP address. Users should revoke any unauthorized wallet approvals via tools such as revoke.cash and avoid interacting with unsolicited links. While the current risk is elevated due to active distribution, continued monitoring and proactive takedown requests to Cloudflare are advised to mitigate long-term exposure. Remaining risk includes potential repackaging of the drainer kit under new subdomains or slight variations, requiring vigilant signature updates.