shiny-tree-1b8c[.]cxxdw[.]workers[.]dev

Is shiny-tree-1b8c.cxxdw.workers.dev Safe?

shiny-tree-1b8c.cxxdw.workers.dev presents an active cryptocurrency wallet phishing threat, currently under investigation for deceptive impersonation of legitimate wallet interfaces. This domain is designed to trick users into entering sensitive wallet credentials or private keys, posing a high risk of financial theft and account compromise. The phishing campaign leverages cloud-based infrastructure to host fraudulent wallet login pages, often distributed through phishing emails or malicious ads targeting cryptocurrency users.

This domain was flagged by PhishDestroy, MetaMask, and SEAL, and is blocked by these services due to confirmed malicious activity. It resolves to IP address 172.67.157.56 and is registered through Cloudflare, Inc. The SSL certificate issued by Let’s Encrypt suggests an attempt to appear legitimate, but VirusTotal reports 0 detections out of 95 scanners, indicating it currently evades most automated detection systems. This combination of low detection rates and active blocklist presence signals an emerging and evolving threat that requires immediate caution.

To mitigate risk, users should avoid interacting with this domain entirely. If you've already visited, do not enter any wallet credentials or private keys. Revoke any permissions granted through your wallet provider’s official interface and run a security scan on your device. Report the domain to your wallet provider and relevant cybersecurity authorities such as PhishDestroy. Always verify URLs manually and use hardware wallets or official apps for transactions. Never click unsolicited links claiming to offer wallet access.