shpaga[.]pages[.]dev

shpaga.pages.dev impersonates TokenRadar, a blockchain security entity, to deceive users. Detected by PhishDestroy on June 21, 2026, this domain is flagged as malicious by 3 out of 91 vendors on VirusTotal. It is also listed on one public blocklist, specifically PhishDestroy's. The domain, registered through Cloudflare, Inc., hosted on IP 172.66.44.150 in the US, and utilizing an SSL certificate from Google Trust Services, has been taken offline.

The domain's platform risk score of 61 out of 100 indicates a significant threat level. The phishing operation likely aimed to exploit users interested in blockchain security by mimicking the TokenRadar brand. This tactic is common among cybercriminals seeking to harvest sensitive information or distribute malware under the guise of legitimate services.

Despite its current offline status, the domain's initial activity highlights the importance of early detection. PhishDestroy's proactive measures captured this threat before it could propagate widely. The domain's presence on VirusTotal with only 3 detections underscores the challenge of timely identification in the cybersecurity landscape. This case exemplifies the critical role of threat intelligence in identifying and mitigating phishing threats during the early stages of their lifecycle.