support-blue-walet-en[.]pages[.]dev

PhishDestroy identifies support-blue-walet-en.pages.dev as an active crypto wallet phishing domain leveraging a deceptive brand name to trick users into divulging seed phrases or private keys. No known drainer kit components have been extracted from static analysis, suggesting a lightweight landing page designed solely to harvest credentials. The domain mimics legitimate ‘Blue Wallet’ branding to exploit user trust in crypto storage solutions, with no obfuscation layer detected, indicating early-stage deployment or a simplistic campaign.

Technical analysis reveals key indicators: 2 out of 95 VirusTotal engines flagged the URL as malicious as of latest scan, and the domain resolves to IP 188.114.97.3, hosted via Cloudflare, Inc. with a Google Trust Services SSL certificate. While creation date and Google Safe Browsing (GSB) status remain under investigation, the absence of detections and blocklist entries suggests the threat is newly emergent or deliberately evasive. The IP is associated with known dynamic hosting environments, commonly used in phishing campaigns to avoid static takedowns.

As of current status, the domain remains active with risk level under investigation, implying ongoing monitoring by security vendors. No takedown actions have been publicly recorded, and the site continues to serve phishing content targeting cryptocurrency users. Users are advised to avoid interaction and report any observed activity. Remaining risk is assessed as moderate due to low detection coverage and potential for rapid expansion via social engineering vectors such as fake support chats or airdrop scams.