new-f07[.]pages[.]dev

PhishDestroy identifies new-f07.pages.dev as an ACTIVE crypto drainer domain impersonating Blink402. The page lures users into linking wallets to a fraudulent API service, automatically draining cryptocurrency upon signature approval. This threat is classified as under_investigation at high risk due to the irreversible nature of asset loss and the domain's current operational status.

This domain was flagged with VirusTotal showing 0/95 detections despite active hosting, resolving to IP 172.66.44.90 via Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, a tactic often used to lend false legitimacy to malicious sites. No presence on public blocklists has been recorded at this time, and the domain's creation through Cloudflare obscures WHOIS details, delaying takedown efforts. The page title 'Blink402 - Turn APIs into Paid Links' directly mirrors the Blink402 branding while promoting a counterfeit service designed to harvest wallet credentials and drain funds.

Immediate mitigation is required: users should avoid interacting with new-f07.pages.dev entirely. Verify any Blink402-related service through official channels listed on the legitimate Blink402 website or verified social media profiles. Enable wallet allow-listing and revoke suspicious API permissions via tools like Revoke.cash or wallet-specific security settings. Report the domain to PhishDestroy and your wallet provider to prevent further propagation. Cloudflare should be notified to deactivate the domain given its abuse of their infrastructure. Remain vigilant for deceptive API integration prompts that request wallet signatures without clear, verifiable benefits.