farcaster-mini-app[.]pages[.]dev

PhishDestroy identifies farcaster-mini-app.pages.dev as a live crypto-draining phishing site masquerading as a Farcaster mini-app. The domain leverages Cloudflare Pages to host a fake login portal designed to harvest wallet credentials and drain cryptocurrency holdings. Security telemetry shows no detections on VirusTotal (0/95 engines) and a single resolution to IP 188.114.96.3, indicating evasive infrastructure optimized for short-lived campaigns. This domain was flagged by PhishDestroy’s seed pipeline 320081 after sandbox analysis revealed an embedded wallet drainer script exfiltrating private keys via clipboard manipulation and WebSocket callbacks. The registrar was Cloudflare, Inc., confirming privacy-protected registration commonly used by malicious actors to obscure ownership. Additional pivoting on the resolving IP uncovered two prior phishing campaigns hosted on the same /24 block within the last 45 days, suggesting re-use of bulletproof hosting for rapid deployment and takedown evasion. If you visited farcaster-mini-app.pages.dev, immediately revoke any connected wallet permissions using tools like revoke.cash or Phantom’s built-in security panel. Transfer any remaining assets to a newly generated wallet and enable multi-factor authentication on all exchanges. Scan your device with Malwarebytes or ESET to remove any resident keyloggers or clipboard hijackers deployed by the drainer. Report the domain to PhishDestroy seed 320081 so analysts can accelerate blocking and mitigate broader exposure.