hickory-batch-phpmu[.]pages[.]dev

PhishDestroy has flagged hickory-batch-phpmu.pages.dev as a suspected crypto drainer actively luring users into connecting cryptocurrency wallets. The domain disguises itself under Cloudflare’s Pages.dev service, creating a false sense of legitimacy while hosting malicious JavaScript designed to siphon funds from unsuspecting victims. These drainers often masquerade as legitimate crypto services, NFT mints, or wallet authentication pages, tricking users into signing malicious blockchain transactions that transfer all assets to attacker-controlled wallets. If you encounter this domain—or any similar-looking link—do not connect your wallet or enter any credentials under any circumstances. This domain was flagged by PhishDestroy using seed 0b48ca after analysis confirmed zero detections on VirusTotal despite clear malicious intent. The site was registered through Cloudflare, Inc., which explains the use of pages.dev subdomains often exploited for quick, low-cost phishing deployments. The domain currently resolves to IP 172.66.46.223 and holds a valid Let's Encrypt SSL certificate, giving it an air of authenticity that deceives automated detection tools. While the exact creation date is not publicly available, the domain remains active and unflagged by most scanning engines as of this report, highlighting a dangerous gap in conventional threat intelligence coverage. If you have visited hickory-batch-phpmu.pages.dev and connected a wallet or entered any information, immediately revoke all token and wallet approvals using tools like Revoke.cash or RabbitHole. Disconnect the wallet from your browser, clear cached data, and run a full antivirus scan. Report the domain to PhishDestroy and your wallet provider, and avoid any future interaction. Always verify URLs manually—especially those hosted on free services like pages.dev—and use PhishDestroy’s real-time verification tool before clicking any link related to crypto or financial transactions.