due-bxa[.]pages[.]dev

The domain due-bxa.pages.dev is currently active and identified as a high-risk crypto drainer phishing site. Analysis indicates the page impersonates MultiChainsFI, a decentralized applications platform, with the explicit intent to drain cryptocurrency assets from victims. The site remains operational and has evaded takedown efforts as of the latest verification. Infrastructure analysis reveals the domain was registered on April 4, 2026, through Cloudflare, Inc., a registrar frequently leveraged for rapid deployment of malicious infrastructure. It resolves to the IP address 188.114.96.3, geolocated to Canada and associated with Cloudflare’s content delivery network. Detection metrics show the domain is flagged by 6 of 95 security vendors on VirusTotal, while appearing on two independent security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy but does not mitigate the underlying threat. Additional automated detection systems have classified this domain as malicious, reinforcing its high-risk classification. Current status confirms the domain remains active, with no evidence of remediation or suspension. Users are strongly advised to block all connections to due-bxa.pages.dev at the network and endpoint levels. Organizations should update security policies to include this domain in deny lists and monitor for related indicators of compromise, such as wallet transaction anomalies or unauthorized access to decentralized finance platforms. Proactive measures, including user education on recognizing crypto drainer tactics and verifying platform authenticity, are critical to mitigating exposure to this threat.