redstone-fi[.]pages[.]dev

This domain, redstone-fi.pages.dev, is flagged as an active crypto drainer phishing site impersonating the RedStone decentralized oracle service. Analysis of the page title and visual elements confirms the site mimics the legitimate RedStone interface, likely designed to deceive users into connecting wallets and executing malicious smart contracts that siphon cryptocurrency assets. No specific drainer kit signature has been attributed at this time, but the domain exhibits behavioral patterns consistent with known crypto theft operations. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on March 27, 2026, and currently resolves to the IP address 172.66.44.216, geolocated to a Cloudflare node in California. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for Cloudflare-hosted properties. Despite its malicious intent, the domain remains undetected by antivirus engines, with a VirusTotal score of 0/95. However, it appears on three independent security blocklists, indicating prior identification by threat intelligence platforms. Google Safe Browsing does not currently flag this domain. As of the latest verification, redstone-fi.pages.dev remains active and accessible, posing an ongoing risk to users unfamiliar with RedStone’s authentic domain structure. Immediate mitigation steps include browser-based blocking via security extensions and network-level filtering of the IP 172.66.44.216. Given the domain’s recent creation and lack of widespread detection, users are advised to verify all RedStone-related URLs through official channels and avoid connecting wallets to unverified interfaces. The continued use of Cloudflare infrastructure suggests potential challenges in takedown efforts, necessitating vigilance from both users and security teams.