ventuals-dnn[.]pages[.]dev

PhishDestroy identifies ventuals-dnn.pages.dev as an active crypto drainer scam site, currently under investigation with a high-risk status. This domain mimics legitimate services to deceive users into connecting cryptocurrency wallets, resulting in unauthorized fund transfers. The threat actor leverages Cloudflare Pages to host malicious content, exploiting Google Trust Services SSL certificates to appear credible and evade detection. Users should treat this domain as hostile and avoid all interactions to prevent financial loss.

This domain was flagged by 3 of 95 VirusTotal vendors, indicating it has not yet been widely recognized by security engines. It resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Cloudflare’s infrastructure to obfuscate its true origin. The SSL certificate, issued by Google Trust Services, adds a veneer of legitimacy, while the domain itself remains unlisted on major blocklists with no current trust scores reflecting its malicious nature. These factors contribute to its deceptive appearance and delayed detection.

The domain is currently active and poses an imminent threat to users who may inadvertently connect their wallets or input sensitive information. PhishDestroy recommends blocking ventuals-dnn.pages.dev at the network and endpoint levels, removing any bookmarks or saved links to the domain, and educating users about the risks of interacting with unverified crypto-related services. Immediate reporting to PhishDestroy and relevant blockchain security teams is advised to mitigate further spread. Additionally, users who have already interacted with this domain should revoke any connected wallet permissions and monitor their accounts for suspicious transactions.