qwoeqwoeuqwjfd[.]pages[.]dev

PhishDestroy identifies the domain qwoeqwoeuqwjfd.pages.dev as an active cryptocurrency drainer phishing site under investigation due to rising reports of wallet-draining malware impersonating legitimate services. The site leverages Cloudflare Pages to host malicious JavaScript payloads designed to intercept and exfiltrate private keys or seed phrases from cryptocurrency wallets, posing a direct threat to digital asset security. Without immediate intervention, users connecting wallets or entering credentials risk irreversible financial loss.

Technical indicators from this domain reveal a concerning lack of detection, with 0 out of 95 VirusTotal engines flagging the threat as of current scans, suggesting the payload remains undetected by many antivirus solutions. The domain is registered through Cloudflare, Inc., resolving to IP 188.114.97.3 and secured with a Google Trust Services SSL certificate, which adds superficial legitimacy but does not guarantee safety. The use of Cloudflare Pages and a Google-issued certificate is a common tactic employed by threat actors to evade blacklists and build trust with potential victims.

To mitigate risk, users should immediately cease interacting with qwoeqwoeuqwjfd.pages.dev and avoid connecting any wallets or entering private keys. Verify the legitimacy of any crypto-related website by cross-checking domain names, SSL certificates, and official brand communications. Utilize hardware wallets where possible and enable multi-factor authentication on all exchange and wallet accounts. Report this domain to PhishDestroy and relevant cybersecurity platforms to expedite blacklisting, and consider revoking any connected wallet permissions if exposed. Proactive monitoring of wallet transactions is strongly advised to detect unauthorized transfers early.