cjmodules[.]pages[.]dev

PhishDestroy identifies cjmodules.pages.dev as an ACTIVE phishing domain currently under investigation for hosting a generic phishing landing page, specifically suspected of acting as a crypto drainer to steal cryptocurrency wallet credentials and assets.

This domain presents a critical threat intersecting multiple red flags across key security metrics. VirusTotal currently reports zero detections out of 95 antivirus engines—indicating zero proactive blocking by mainstream security vendors as of the latest scans. The domain resolves to IP address 172.66.45.30, which is hosted under Cloudflare’s infrastructure, registered through Cloudflare, Inc., and secured with a Google Trust Services SSL certificate. These factors combine to create a stealthy, professionally disguised phishing infrastructure.

PhishDestroy advises immediate verification and blacklisting of this domain due to its active status and zero AV coverage. Users interacting with any links or forms on cjmodules.pages.dev—especially those involving cryptocurrency transactions—should assume credential or asset theft risk. Mitigation includes blocking the domain at network and endpoint levels, scanning crypto wallets for unauthorized transactions, rotating private keys if exposed, and reporting the domain to PhishDestroy via the platform’s real-time threat feed to prevent further propagation.