shido-datafixed[.]pages[.]dev

PhishDestroy identifies shido-datafixed.pages.dev as a live crypto wallet drainer kit actively masquerading under Cloudflare Pages infrastructure. The domain leverages deceptive naming to impersonate legitimate data-related services, likely targeting cryptocurrency users with a fake drainer scheme designed to siphon funds from connected wallets. No specific brand or service affiliation has been confirmed at this stage, but the use of a drainer kit strongly suggests a financial motive tied to digital asset theft.

This domain exhibits a precise technical footprint that confirms its malicious nature. It currently shows 0 detections out of 95 on VirusTotal, has been registered through Cloudflare, Inc., and resolves to IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, adding a false veneer of legitimacy. According to internal telemetry, the domain has appeared on 2 independent security blocklists and is currently blocked by Enkrypt and ScamSniffer. Notably, it remains unflagged by the broader security community, highlighting a window of exposure before widespread recognition.

As of this advisory, shido-datafixed.pages.dev is classified with a status of 'active' and risk level 'under_investigation'. Immediate defensive actions have included blocking by Enkrypt and ScamSniffer, with additional blocklisting in progress. While the low VirusTotal detection rate suggests limited visibility, the presence of a drainer kit and confirmed malicious intent elevates the risk to users interacting with crypto platforms. Users should ensure their wallets and browser extensions are updated, avoid unsolicited links, and verify any data-related prompts through official channels. Remaining risk remains moderate due to the domain’s recent emergence and stealth deployment via reputable infrastructure.