dapphubs[.]pages[.]dev

PhishDestroy analysts have identified the active crypto drainer domain dapphubs.pages.dev impersonating a legitimate cryptocurrency hub to facilitate fund theft. This fraudulent site leverages a Pages.dev subdomain to mimic a trusted development platform while deploying malicious JavaScript designed to drain connected crypto wallets. The infrastructure closely resembles known crypto-draining kits observed in recent campaigns targeting DeFi users.

This domain was flagged under investigation (Unique Seed: a8a1bf) with the following technical indicators: 0 detections on VirusTotal out of 95 engines as of the latest scan, registered through Cloudflare, Inc., resolving to IP 172.66.44.101, secured with a Google Trust Services SSL certificate, and currently not flagged on Google Safe Browsing. The domain remains unlisted on major threat intelligence blocklists, indicating a newly emerged or stealthily operated operation.

The threat remains active with low current detection coverage, presenting elevated risk to unprotected users. PhishDestroy recommends immediate blocking of dapphubs.pages.dev at network and endpoint levels. Users are advised to avoid interacting with any unsolicited crypto-related links, verify domains via official channels, and enable wallet protections such as transaction simulation and allowlisting. Security teams should monitor for related infrastructure and update firewall rules accordingly. Remaining risk is assessed as high due to low detection rates and active operation status.