evm-ipfs-validation[.]pages[.]dev

PhishDestroy identifies evm-ipfs-validation.pages.dev as a crypto drainer actively hosting a fake EVM IPFS validation service. The domain is classified under generic phishing with an under-investigation risk level and remains active. This threat specifically targets cryptocurrency users by masquerading as a legitimate validation portal to trick victims into connecting wallets or entering private keys.

This domain resolves to IP 188.114.96.3 and currently shows 4 out of 95 VirusTotal detections as of the latest scan. It is registered through Cloudflare, Inc., which provides anonymity and CDN-based obfuscation, and holds an SSL certificate issued by Google Trust Services, enhancing its appearance of legitimacy. While creation date and blocklist status are not explicitly disclosed, the absence of detections on VirusTotal and the use of Cloudflare’s infrastructure suggest a recently deployed or stealthily operated campaign. The combination of low detection rate, Cloudflare hosting, and a Google-issued certificate indicates a sophisticated setup aimed at evading traditional security measures.

Users should immediately avoid interacting with evm-ipfs-validation.pages.dev or any associated links claiming to offer EVM IPFS validation. To mitigate risk, verify all validation portals through official blockchain explorer tools or trusted project websites. Enable wallet address verification before signing any transactions, and use hardware wallets or multi-signature setups for high-value assets. Report suspicious domains to PhishDestroy and consider blocking the IP 188.114.96.3 at the network level. Always cross-check URLs using PhishDestroy’s real-time threat intelligence to confirm legitimacy before entering credentials or connecting wallets.