notbotme[.]pages[.]dev

PhishDestroy identifies notbotme.pages.dev as a live crypto drainer domain actively harvesting cryptocurrency from unwitting users. This Cloudflare-registered site (188.114.96.3) lures victims with fake security tools under the guise of detecting bots, then silently drains connected wallets. The domain uses Google Trust Services SSL certificates to appear legitimate while hosting malicious scripts that monitor clipboard activity for crypto wallet addresses and replace them with attacker-controlled addresses. Recent scans show zero detection on VirusTotal despite active exploitation, indicating this threat is currently flying under security radar. This domain was flagged by PhishDestroy with the following technical indicators: resolves to IP 188.114.96.3, protected by Cloudflare registrar, carries valid Google Trust Services SSL certificate, and maintains 1/95 VirusTotal detections as of latest analysis. The site's pages.dev subdomain indicates recent creation through Cloudflare's worker platform, which attackers increasingly abuse to rapidly deploy and rotate malicious infrastructure. Security researchers note this domain specifically targets cryptocurrency users through social engineering campaigns promising 'bot detection' services. If you or anyone in your organization visited notbotme.pages.dev, immediately disconnect all wallets and revoke any connected permissions through your wallet provider's security settings. Scan all devices used for cryptocurrency transactions with updated antivirus software, particularly checking for clipboard hijackers and wallet drainers. Report this domain to your wallet provider and consider transferring remaining assets to new, clean wallets. Block this domain at your network level and warn all cryptocurrency users in your network about this specific crypto drainer campaign.