sustainable-business-carbon-credits[.]pages[.]dev

PhishDestroy identifies sustainable-business-carbon-credits.pages.dev as a malicious domain actively hosting a crypto drainer campaign designed to deceive users into connecting cryptocurrency wallets under the guise of carbon credit transactions. This threat specifically targets users interested in sustainable business practices, tricking them into authorizing wallet transactions that drain funds to attacker-controlled addresses. The domain leverages Cloudflare Pages for hosting, which provides a veneer of legitimacy while obscuring the true infrastructure. Security researchers should treat this domain as a high-priority threat due to its active status and the potential for financial loss. This domain was flagged with zero detections on VirusTotal (0/95) and resolves to IP 188.114.96.3. It is registered through Cloudflare, Inc., and operates under a Google Trust Services SSL certificate, which may further obscure its malicious nature from casual inspection. The domain’s use of the .pages.dev subdomain suggests an attempt to impersonate legitimate Cloudflare Pages deployments, while the sustainable business theme is likely chosen to attract environmentally conscious users. Security teams should monitor this domain for additional infrastructure pivots and update blocklists to prevent further exploitation. Users who have visited this domain should immediately disconnect any connected cryptocurrency wallets and revoke any unauthorized permissions granted to wallet applications. If transactions were authorized, users must contact their wallet provider and file incident reports with relevant platforms. Enable transaction alerts and consider transferring remaining funds to a cold wallet if suspicious activity is detected. Report this domain to PhishDestroy and your organization’s security team to aid in ongoing threat intelligence sharing.