jhgf-4uz[.]pages[.]dev

PhishDestroy identifies jhgf-4uz.pages.dev as an active crypto drainer scam site currently under investigation. This domain is designed to steal cryptocurrency from unsuspecting users by tricking them into connecting their wallets to malicious smart contracts. The threat remains active despite limited vendor detection, requiring immediate action from security teams and potential victims. This domain was flagged by 2 of 95 VirusTotal vendors, indicating extremely low detection rates despite its active status. It resolves to IP address 188.114.96.3 and operates under a Google Trust Services SSL certificate. The domain is registered through Cloudflare, Inc., with the seed identifier f930c9 suggesting this is part of a broader investigation into similar malicious infrastructure. The combination of Cloudflare's protection services with a legitimate SSL certificate creates a dangerous false sense of security for potential victims. The current status remains active, with this domain actively distributing malicious content to unsuspecting users. While technical indicators show sophisticated obfuscation techniques to evade detection, the lack of vendor flags suggests this may be a newly deployed threat. Users should immediately block this domain at their network level and avoid any wallet connections. Security teams should monitor for similar domains using this exact infrastructure fingerprint, particularly those resolving to 188.114.96.3 or using the same SSL certificate. Immediate reporting to PhishDestroy is recommended for further analysis and potential takedown coordination.