ewnewiopjoesa[.]pages[.]dev

PhishDestroy identifies ewnewiopjoesa.pages.dev as an active generic phishing domain leveraging a drainer kit to harvest user credentials and cryptocurrency wallet access. The site impersonates no specific brand, instead deploying a generic but high-risk lure to trick victims into entering sensitive data. The domain was registered via Cloudflare, Inc., resolving to IP 172.66.44.227 with a Google Trust Services SSL certificate, indicating basic infrastructure hardening to appear legitimate while evading early-stage detection. This domain exhibits a low initial detection profile, with VirusTotal showing 8/95 detections as of analysis seed 1235c1. It operates under Cloudflare’s infrastructure with IP 172.66.44.227 and uses a Google Trust Services SSL certificate for added credibility. The domain remains unblocked across major threat intelligence platforms, increasing exposure to potential victims. While creation date and blocklist counts are not publicly disclosed, its use of a Pages.dev subdomain hosted on Cloudflare suggests recent deployment and low historical reputation. The domain remains active and under investigation, with no confirmed takedown as of this assessment. Users should block access at the network level and report the domain to threat intelligence platforms and CERT teams. Remaining risk is moderate due to low initial detection and reliance on generic lures, but rapid evolution into brand impersonation is likely. Continuous monitoring of new IOCs is recommended to prevent compromise.