kukai-3i0[.]pages[.]dev

This domain hosts a counterfeit login page mimicking the legitimate Kukai wallet interface, tricking users into entering private keys or recovery phrases into a fake form. Once submitted, the credentials are immediately harvested by attackers, granting them full control over victims’ crypto assets. The site is indistinguishable from the real service, making it especially dangerous for users who rely on browser bookmarks instead of typing URLs. PhishDestroy confirmed this site is active but undetected by 7 out of 95 VirusTotal engines, showing it remains under the radar. It is registered via Cloudflare, Inc. and secured with a Let’s Encrypt certificate to appear legitimate, while resolving to IP 188.114.96.3. The domain’s recent Cloudflare Pages deployment indicates an opportunistic campaign likely targeting users searching for wallet access points. If you visited this page, stop using any credentials you entered immediately. Revoke access to all connected wallets via the official Kukai interface, transfer remaining funds to a new wallet created on the genuine site, and run a malware scan on your device. Report the domain to your browser’s safe-browsing program and avoid clicking similar links in future.