hu4[.]pages[.]dev

PhishDestroy identifies hu4.pages.dev as an active crypto drainer posing as a login portal. This high-risk domain (83c77e) is designed to trick users into submitting wallet credentials or connecting crypto wallets, enabling threat actors to drain funds directly. The site is currently unresolved on major phishing indexes but has already been blocked by PhishingDB and flagged by Google Safe Browsing under the category of SOCIAL_ENGINEERING. With 20 out of 95 VirusTotal security vendors currently detecting malicious activity, this domain represents a credible and evolving threat to cryptocurrency users.

This domain was registered through Cloudflare, Inc., resolving to IP 172.66.44.220 and secured with a Google Trust Services SSL certificate. VirusTotal analysis indicates early-stage evasion techniques, with detections concentrated among behavioral AI engines and crypto-focused scam classifiers. The domain is hosted on Cloudflare Pages, a legitimate platform often abused by threat actors to rapidly deploy malicious sites with minimal cost. Based on available telemetry, hu4.pages.dev was likely deployed within the past 30 days, consistent with the lifecycle of opportunistic crypto drainer campaigns targeting unsuspecting users.

If you visited hu4.pages.dev, immediately disconnect any connected wallets, revoke permissions through your wallet interface or tools like Revoke.cash, and run a full system scan using reputable antivirus software. Do not enter any credentials or authorize transactions. Report the domain to PhishDestroy using the unique seed 83c77e for tracking and block propagation. Monitor your wallet and transaction history for unauthorized activity. Exercise extreme caution with any unsolicited links—especially those claiming to offer login portals, airdrops, or wallet connection requests. Always verify URLs manually and use hardware wallet confirmation for high-value transactions.