ticketsolutions[.]pages[.]dev

PhishDestroy identifies ticketsolutions.pages.dev as an active phishing domain impersonating a DApp Ecosystem Hub to deceive cryptocurrency users into connecting wallets or submitting credentials. The attack leverages a generic-but-legitimate-sounding title to lower user suspicion while hosting malicious content on a Cloudflare Pages subdomain. Security scanners have yet to flag the page, leaving visitors exposed to credential theft or wallet drainers. This domain resolves to IP address 172.66.47.165 and operates under a Let's Encrypt SSL certificate to appear trustworthy. VirusTotal shows 0 detections out of 95 engines as of the latest scan, and the registrar is Cloudflare, Inc., indicating use of Cloudflare Pages for rapid deployment and evasion. No blocklist entries or trust-score degradations are currently recorded, suggesting the infrastructure remains under the radar despite ongoing malicious activity. The page title “DApp Ecosystem Hub” is crafted to mirror legitimate decentralized application directories, increasing the likelihood of user interaction. To mitigate exposure, users should avoid visiting ticketsolutions.pages.dev and block the domain at network and DNS levels. Organizations are advised to inspect outbound connections to IP 172.66.47.165 and monitor for wallet connection prompts originating from this domain. Security teams should integrate IOCs (domain, IP, ASN) into firewalls and email filters while submitting fresh samples to threat intelligence platforms to improve detection coverage.