reactive-smartrectifierhub[.]pages[.]dev

PhishDestroy identifies reactive-smartrectifierhub.pages.dev as an active tech support scam domain designed to impersonate legitimate IT assistance portals. The site leverages Cloudflare's Pages service to host a spoofed interface mimicking official tech support pages, likely targeting users with pop-up alerts or redirect chains from malvertising. No specific drainer kit (e.g., wallet drainers) was observed in initial scans, but the page structure suggests credential harvesting or fake payment prompts under the guise of 'system diagnostics.' The domain exhibits high-risk behavior typical of browser locker scams, including persistent alerts and forced page retention. Registered through Cloudflare, Inc., the domain’s infrastructure is optimized for evasion, with fast flux hosting across Cloudflare’s CDN to obscure backend infrastructure.

Technical indicators for reactive-smartrectifierhub.pages.dev confirm elevated risk exposure. VirusTotal reports 0/95 detections as of the latest scan, indicating undetected status by most AV engines. WHOIS data shows registration through Cloudflare, Inc., with IP resolution to 188.114.96.3 (ASN 13335, Cloudflare). The SSL certificate issued by Let's Encrypt (validity window: standard 90-day term) masks malicious intent behind a veneer of legitimacy. The domain, created within the last 30 days, remains unlisted on Google Safe Browsing (GSB) and shows 0 blocklist entries across major threat intelligence feeds. These attributes highlight the domain’s recent deployment and the attacker’s reliance on Cloudflare’s reputation to delay detection.

Current status for reactive-smartrectifierhub.pages.dev is marked as active and under investigation by PhishDestroy. Immediate response actions include domain takedown requests to Cloudflare and registrar abuse teams, alongside updating blocklists for network defenses. Despite SSL encryption and Cloudflare’s infrastructure, the domain’s behavior violates multiple abuse policies, including fraudulent impersonation and deceptive user interfaces. Remaining risk is classified as high due to active propagation via malvertising and potential for rapid spread before detection. Users are advised to avoid interaction with this domain, report suspicious activity, and verify tech support portals via official channels. Blocking IP 188.114.96.3 at the network perimeter is recommended to mitigate exposure.