bit-3dh[.]pages[.]dev

PhishDestroy identifies bit-3dh.pages.dev as an active crypto drainer phishing domain currently under investigation for generic phishing activities. This Cloudflare Pages deployment resolves to IP 172.66.44.149 using a Let's Encrypt SSL certificate, indicating an attempt to appear legitimate while exfiltrating cryptocurrency wallet credentials. The domain's structure mimics legitimate services, with particular focus on crypto-related operations that could deceive users into connecting malicious wallet interfaces. Security researchers should treat this as a high-priority threat due to its active status and zero detection rate across major antivirus engines. This domain was flagged with 0 detections out of 95 VirusTotal scans, registered through Cloudflare, Inc. with IP resolution to 172.66.44.149. The Let's Encrypt SSL certificate suggests an attempt to establish trustworthiness while hosting malicious content. The specific threat involves crypto drainer functionality, where victims' wallet connections would automatically transfer funds to attacker-controlled addresses without requiring private key extraction. The domain's pages.dev subdomain indicates an attempted exploitation of Cloudflare's legitimate service to host malicious content while maintaining operational security through Cloudflare's infrastructure. Users who visited bit-3dh.pages.dev should immediately disconnect any connected wallets, revoke any approved permissions through their wallet interface, and transfer remaining funds to a newly generated address. Scan all devices that accessed this domain for malware, particularly browser extensions that might capture wallet credentials. Report any unauthorized transactions to your wallet provider and local cybercrime units. Add the domain to your browser's blocklist and DNS blacklists while monitoring for related domains that may share infrastructure. Consider enabling hardware wallet signing for all transactions to prevent automatic fund transfers.