waf-6gf[.]pages[.]dev

PhishDestroy identifies waf-6gf.pages.dev as a live crypto drainer kit targeting wallet login credentials through a generic phishing lure. The domain mimics legitimate service authentication flows to harvest private keys or seed phrases. Cloudflare Pages infrastructure is abused to host the fraudulent interface, leveraging free TLS certificates from Google Trust Services to appear legitimate. No specific brand impersonation is detected at this stage—users should treat all wallet prompts from this domain as hostile.

This domain was flagged with a 1/95 VirusTotal detection score, indicating no antivirus or security vendor has yet flagged the payload. It was registered through Cloudflare, Inc. using their Pages service, resolving to IP 172.66.45.7. The SSL certificate is issued by Google Trust Services, and the threat type is classified as a generic phishing attack with crypto-draining capabilities. As of this assessment, no blocklist entries have been recorded, and creation date remains unverified but inferred as recent due to lack of historical data.

The domain is currently active and under active investigation by PhishDestroy’s threat intelligence team. Immediate response actions include domain reputation flagging, IP-based blocking, and integration into browser-based intervention systems. Despite its low detection rate, the presence of a drainer kit and active infrastructure elevates the immediate risk to 'under_investigation'—users are strongly advised to avoid interaction and verify any suspicious wallet authentication pages using PhishDestroy’s real-time verification tool.