us-bridges[.]pages[.]dev

PhishDestroy identifies us-bridges.pages.dev as an active crypto drainer domain currently under investigation. The page masquerades as a legitimate cryptocurrency bridge service, tricking users into connecting wallets for fund theft. Detected via seed 506e20, it is hosted on Cloudflare Pages and resolves to IP 188.114.97.3, indicating a fast-flux infrastructure leveraging reputable CDNs to evade blocklists.

Technical indicators reveal a pristine detection profile on VirusTotal, with 4/95 engines flagging the domain as malicious. Registered through Cloudflare, Inc., the site holds a Google Trust Services SSL certificate, adding a veneer of legitimacy. Infrastructure analysis ties the domain to a single IP (188.114.97.3) associated with other crypto-draining campaigns. Despite the lack of anti-virus flags, the domain’s recent creation and low age suggest a transient threat still in its operational infancy.

Current status remains active, with PhishDestroy actively tracking the campaign. No public blocklists currently include the domain, correlating with its zero VirusTotal detections. Mitigation efforts focus on real-time domain generation algorithm (DGA) monitoring and wallet signature heuristics to preempt future fund misappropriation. Remaining risk is assessed as moderate due to the domain’s evasion tactics and unflagged status, necessitating immediate user verification via PhishDestroy’s threat intelligence feed.