rrr1-5o0[.]pages[.]dev

PhishDestroy identifies rrr1-5o0.pages.dev (seed baec03) as an active generic phishing domain actively pushing a crypto-asset drainer kit. The lure mimics the branding and login flow of a top-tier wallet service to trick users into authorizing malicious token transfers via a web3 interaction popup. No specific wallet brand is named in the observed payload, indicating a generic but high-impact drainer designed to harvest private keys and seed phrases through deceptive authorization requests.

Technical indicators point to a recently registered domain hosted on Cloudflare Pages. VirusTotal shows zero detections (6/95 engines) despite the domain resolving to 172.66.47.152 via Cloudflare’s infrastructure. The SSL certificate is issued by Google Trust Services, a common practice among threat actors leveraging legitimate issuers to bypass network filters. WHOIS data reveals Cloudflare, Inc. as the registrar, with the domain created within the last 30 days, confirming its ephemeral nature. At the time of analysis, the domain remains unlisted on major blocklists and maintains a clean Google Safe Browsing (GSB) status, enabling it to evade initial detection layers.

Current status is active with an under-investigation risk rating. PhishDestroy has flagged the domain and deployed countermeasures through its real-time blocklist, but the combination of zero AV detections, clean GSB status, and Cloudflare hosting prolongs exposure risk. Users should immediately block traffic to 172.66.47.152 and inspect any recent web3 authorization requests linked to rrr1-5o0.pages.dev. Remaining risk is moderate due to unflagged status but mitigated by proactive threat intelligence feeds and browser extension rules. Immediate verification via PhishDestroy’s lookup tool is strongly recommended before any further interaction.