uphlldcom-logn[.]pages[.]dev

PhishDestroy identifies uphlldcom-logn.pages.dev as an active crypto drainer scam targeting cryptocurrency users. This malicious domain impersonates legitimate platforms to trick visitors into connecting crypto wallets, where drainer scripts silently extract funds. The site operates under Cloudflare’s infrastructure, resolving to IP 188.114.97.3 with a Google Trust Services SSL certificate—a common tactic to appear trustworthy while hosting malicious payloads. Given the 7/95 VirusTotal detection rate, traditional antivirus tools may not yet recognize the threat, making manual verification critical before any interaction. This domain was flagged through PhishDestroy’s automated analysis pipeline, which detected crypto drainer signatures embedded in the site’s JavaScript. The domain leverages Cloudflare Pages for hosting, a tactic often used by threat actors to rapidly deploy and rotate malicious infrastructure. Notably, the SSL certificate issued by Google Trust Services adds a false sense of security, as certificates alone do not guarantee a site’s legitimacy. The domain’s recent registration and low detection rate suggest it may be part of a broader campaign targeting unsuspecting cryptocurrency enthusiasts. If you visited uphlldcom-logn.pages.dev, immediately disconnect from the internet and revoke any wallet connections made through the site. Scan your device for malware using reputable security software and consider transferring remaining funds to a new, secure wallet. Report the domain to PhishDestroy and block it in your browser’s hosts file or firewall. For future protection, always verify URLs through PhishDestroy’s database before engaging with crypto-related platforms, and use hardware wallets or multi-signature solutions to mitigate drainer risks.