app-benqi-fi[.]pages[.]dev

PhishDestroy has flagged app-benqi-fi.pages.dev with an elevated risk level, identifying it as a sophisticated crypto drainer designed to impersonate the legitimate BENQI decentralized finance platform. This domain was part of a targeted phishing campaign aimed at stealing cryptocurrency wallets and private keys from unsuspecting users. Although currently offline, the threat landscape remains active, and similar clones may reappear.

Technical analysis reveals that the domain resolves to IP address 172.66.47.4, registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services (WE1). The domain was created on November 10, 2024, and appeared on one security blocklist. VirusTotal flagged it with 1 out of 95 security vendors reporting malicious activity, underscoring its low detection rate and sophisticated evasion techniques. The page title was explicitly set to "BENQI" to deceive users into believing they were interacting with the authentic platform.

To mitigate risks, users should always verify URLs before entering any credentials or connecting wallets. For crypto drainers specifically, never approve contract interactions or sign transactions on untrusted sites. Use hardware wallets and browser extensions like MetaMask's phishing detection. If you have already interacted with this domain, immediately revoke token approvals via tools like Revoke.cash and transfer remaining assets to a new wallet. PhishDestroy recommends continuous monitoring of domain registrations and SSL certificates to preemptively block similar threats.