default-susiswap-trade-en[.]pages[.]dev

PhishDestroy identifies active crypto drainer abuse of default-susiswap-trade-en.pages.dev as a generic phishing campaign under formal investigation since seed bc4e9c. The subdomain masquerades as a legitimate Susiswap trading interface, hosting a malicious token-draining kit designed to siphon crypto assets from unwitting users. Google Pages creator host with Cloudflare-fronted infrastructure indicates an attempt to leverage reputable services to lower suspicion while executing financial theft.

This domain was flagged by PhishDestroy on seed bc4e9c and shows 0 detections out of 95 engines on VirusTotal, placing it below current automated detection thresholds. Registered through Cloudflare, Inc. on an unspecified date, it resolves to IPv4 address 172.66.44.231 and operates behind a Google Trust Services SSL certificate, which provides no authentication benefits to the phishing page itself. The domain remains absent from Google Safe Browsing (GSB) blocklists at this time, providing threat actors unobstructed access for continued exploitation.

As of today, the risk level is marked as active and under investigation, indicating ongoing abuse potential. PhishDestroy has escalated the sample to threat intelligence partners and continues real-time monitoring via seed bc4e9c. Users are strongly advised to avoid interacting with default-susiswap-trade-en.pages.dev and to verify any suspicious crypto-related domains using PhishDestroy’s live scanning service. Remaining risk is classified as elevated due to the drainer’s operational status and the reliance on trusted infrastructure to evade detection.