apikeytronscan[.]pages[.]dev

PhishDestroy identifies apikeytronscan.pages.dev as a domain actively promoting crypto-draining operations through the disguise of legitimate API scanning tools. The site is currently under investigation and is flagged as active, suggesting ongoing malicious campaigns leveraging the '.pages.dev' subdomain space under Cloudflare Pages. Users are advised to treat this domain with caution due to its association with the specific threat of cryptocurrency theft, particularly given its use of a crypto-oriented naming convention designed to lure developers and API users into downloading or interacting with malicious payloads.

This domain resolves to IP address 172.66.44.97 and utilizes a Let's Encrypt SSL certificate, which may enhance its perceived legitimacy. Registration is handled through Cloudflare, Inc., a common choice for threat actors due to its anonymity-friendly infrastructure and rapid deployment capabilities. Notably, VirusTotal currently reports zero detections (1/95) across major antivirus and security platforms, indicating that this domain has evaded detection by mainstream scanning engines as of the latest analysis. Combined with the use of a dynamically generated Certificate Authority (Let's Encrypt) and a subdomain tied to a legitimate hosting platform (pages.dev), the infrastructure appears optimized for stealth and rapid rotation—a hallmark of crypto-draining operations. Given the absence of historical blocklist entries and low trust scores across most reputation engines, the domain presents a high evasion profile. The seed identifier f1435f refers to a persistent tracking hash used by PhishDestroy to monitor this campaign across updated IOC feeds.

To mitigate exposure to this crypto drainer, users should immediately block or avoid interactions with apikeytronscan.pages.dev and any associated subdomains or IPs. Development environments and crypto wallets should be isolated from browsers or systems used to access unknown domains. Implementing DNS filtering solutions and security policies that block access to newly registered or low-reputation domains can prevent accidental exposure. Additionally, enabling transaction simulation tools or hardware wallet signing for all outgoing blockchain transactions can detect unauthorized token transfers before completion. Security teams are advised to monitor for network connections to 172.66.44.97, especially from internal developer workstations or CI/CD pipelines, as these may indicate compromise. Finally, users who may have entered sensitive information or downloaded files from this domain should revoke any exposed API keys, rotate credentials immediately, and review wallet transaction histories for signs of unauthorized activity.