lorem-cu4[.]pages[.]dev

PhishDestroy identifies lorem-cu4.pages.dev as an active crypto drainer phishing domain under investigation for targeting cryptocurrency users. The site masquerades as a legitimate service to trick victims into connecting wallets and signing malicious transactions that drain assets. Initial analysis shows the domain resolves to Google Trust Services-validated infrastructure (IP 188.114.97.3) via Cloudflare, obscuring the true origin while leveraging reputable certificates for credibility. This domain was flagged with 0 detections out of 95 engines on VirusTotal at the time of analysis, indicating low immediate detection but not confirming safety. Registration occurred through Cloudflare, Inc. and the site currently operates as a Pages.dev subdomain, a common tactic for fast deployment and evasion of automated takedowns. The lack of blocklist presence suggests it is newly active or carefully engineered to avoid signatures. With SSL issued by Google Trust Services and hosted on Cloudflare’s edge network, the infrastructure appears benign at a surface level, reducing immediate red flags while enabling malicious behavior. If you visited lorem-cu4.pages.dev, disconnect your wallet immediately and revoke any unauthorized permissions via blockchain explorers or wallet management tools. Do not interact further with the site or enter credentials. Report the domain to your security team or use platforms like URLScan, PhishTank, or Google Safe Browsing to contribute threat intelligence. Consider rotating wallet private keys if transactions were signed and monitor blockchain activity for unauthorized transfers. Always verify domains via official channels before connecting crypto wallets.