tttt-4i4[.]pages[.]dev

PhishDestroy identifies tttt-4i4.pages.dev as a domain actively engaged in crypto drainer operations, currently under investigation for credential theft and fraudulent asset transfers. This domain is flagged as a live threat with a suspicious SSL certificate issued by Google Trust Services, resolving to IP 188.114.97.3. No detections on VirusTotal currently exist, though this may change as further analysis unfolds.

This domain was registered through Cloudflare, Inc. and remains unblocked across known threat intelligence platforms. It currently shows 0 detections from 95 VirusTotal vendors and has no presence in public blocklists. The SSL certificate, issued by Google Trust Services, lends a false sense of legitimacy, while the hosting IP (188.114.97.3) is associated with Cloudflare’s infrastructure, complicating takedown efforts. No creation date is publicly available due to Cloudflare’s privacy protections.

Given the lack of current detections but active threat status, immediate defensive actions are recommended. Security teams should block tttt-4i4.pages.dev at the network perimeter and inspect DNS logs for resolutions to 188.114.97.3. Users should be warned against interacting with this domain, especially in crypto-related contexts. Further monitoring is advised as this investigation progresses.