crypto-news8[.]pages[.]dev

PhishDestroy identifies crypto-news8.pages.dev as an active crypto drainer scam distributing malicious payloads to unsuspecting victims. This fraudulent domain masquerades as a cryptocurrency news portal to deceive users into connecting wallets or downloading malware, resulting in asset theft or credential compromise. The site leverages Cloudflare's infrastructure and a Google Trust Services SSL certificate to appear legitimate, while hosting infrastructure on Cloudflare proxy IP 188.114.96.3 to obscure its true origin. This domain currently shows zero detections on VirusTotal from 95 threat intelligence engines, indicating it has evaded immediate automated detection systems despite active malicious operations. The domain was registered through Cloudflare, Inc. and resolves to IP 188.114.96.3, which hosts multiple malicious domains involved in cryptocurrency theft campaigns. This configuration allows the threat actor to rapidly deploy and rotate domains while maintaining operational camouflage, making it challenging for traditional security tools to flag in real time. Users who have accessed crypto-news8.pages.dev should immediately disconnect from the internet, run a full antivirus scan, revoke any connected wallet permissions via a clean device, and change all related credentials. Report the domain to PhishDestroy for verification and remediation. Avoid interacting with any crypto-related prompts or downloads from unverified sources, and use PhishDestroy's live verification tool before engaging with unknown links to prevent financial loss.