cloud-trusrt-tools[.]pages[.]dev

PhishDestroy identifies cloud-trusrt-tools.pages.dev as an active crypto drainer campaign designed to deceive users into connecting cryptocurrency wallets under the guise of legitimate cloud tooling utilities. The domain masquerades as part of a trusted domain infrastructure (pages.dev via Cloudflare), leveraging Google Trust Services for SSL to appear authentic. Threat actors are likely distributing malicious wallet connection prompts or fake download links aimed at draining digital assets from unsuspecting victims. This domain is currently unflagged on VirusTotal with 0 detections out of 95 scans, indicating a low immediate signature-based detection rate and highlighting the need for behavioral and heuristic analysis to identify the threat. This domain was flagged by PhishDestroy under seed 55c197 and is currently active. The domain resolves to IP address 172.66.45.41, registered through Cloudflare, Inc. A key indicator of concern is the absence of detections on VirusTotal (4/95), which suggests this campaign is either newly deployed or intentionally engineered to evade traditional antivirus engines. The use of a .pages.dev subdomain under Google's Pages platform may be an attempt to exploit trust in Google's infrastructure. While the registration date is not provided, the active status and lack of detection imply recent deployment and ongoing operation. Users who have visited cloud-trusrt-tools.pages.dev or interacted with any content on this domain should assume compromise risk, especially if cryptocurrency wallet connections were made or sensitive credentials were entered. Do not interact further with this domain. If a wallet connection was authorized, revoke permissions immediately using your wallet's security settings or official platform tools. Scan your device using reputable security software to check for malware or unauthorized access. Report this domain to PhishDestroy or your security provider with full details to aid in blocking and investigation. Exercise extreme caution with any future cloud tooling-related domains and always verify sources through official channels before engaging.