insidergroup[.]pages[.]dev

PhishDestroy identifies insidergroup.pages.dev as an active crypto drainer campaign leveraging Cloudflare Workers pages to deceive visitors into connecting cryptocurrency wallets and approve malicious token transfers.

This domain was flagged by 16 of 95 VirusTotal vendors as of latest scan, is registered through Cloudflare, Inc., and resolves to IP address 172.66.47.178 assigned to the Cloudflare network range. Google Trust Services issued the SSL certificate for insidergroup.pages.dev as part of the default *.pages.dev wildcard certificate policy, which increases credibility with potential victims unaware of the malicious origin.

The domain remains active and carries high risk due to its use of legitimate Cloudflare infrastructure, zero VirusTotal detections, and lack of inclusion on public blocklists. Users and organizations are advised to block traffic to insidergroup.pages.dev at DNS and network levels, scan endpoints for unauthorized wallet connections, and report the domain to Cloudflare Abuse and relevant threat intelligence platforms to prevent further exploitation.