appuphled-log[.]pages[.]dev

PhishDestroy identifies appuphled-log.pages.dev as an active crypto drainer domain currently under investigation for credential theft. The domain resolves to IP 188.114.96.3, is hosted by Cloudflare, and holds a Google Trust Services SSL certificate. As of the latest scan, VirusTotal reports 0 detections out of 95 scanners, indicating it remains unflagged across major security platforms. This domain was flagged by PhishDestroy’s seed 832983 and is linked to a generic phishing campaign targeting cryptocurrency users. Technical indicators include registration through Cloudflare, Inc., a dynamic IP address associated with multiple high-risk domains, and a recently issued SSL certificate from Google Trust Services—often used to lend false legitimacy to fraudulent sites. The domain’s creation date remains unlisted due to Cloudflare’s privacy protections, but its association with *.pages.dev subdomains suggests recent deployment. Current blocklist inclusion is unverified, though the absence of detections implies it has evaded automated detection thus far. Mitigation for this crypto drainer threat requires immediate action: avoid clicking links or entering credentials on appuphled-log.pages.dev or any related subdomains. Users should verify the legitimacy of cryptocurrency-related websites through official channels and implement wallet restrictions to prevent unauthorized transactions. Additionally, report the domain to threat intelligence platforms like VirusTotal, PhishDestroy, or your security provider. Network defenders are advised to block the IP 188.114.96.3 and monitor for related infrastructure.