protl-project[.]pages[.]dev

protl-project.pages.dev has been identified as an active crypto drainer domain designed to siphon cryptocurrency assets from unsuspecting users. Initial analysis indicates the domain mimics legitimate project branding, luring victims into connecting crypto wallets under false pretenses. The observed infrastructure suggests the use of a generic drainer kit, likely pre-configured to target popular wallet extensions and blockchain networks. The threat actor leverages Cloudflare’s Pages service to host the fraudulent page, providing both anonymity and rapid deployment capabilities. Given the domain’s active status and the specificity of its payload, this operation poses a direct risk to individuals interacting with cryptocurrency platforms or wallets. This domain resolves to IP 188.114.97.3 and operates under a Google Trust Services SSL certificate, further enhancing its legitimacy in the eyes of potential victims. VirusTotal scans yield 13/95 detections, indicating the domain remains undetected by most antivirus and security vendors as of current intelligence. Registered through Cloudflare, Inc., the domain’s creation date and additional metadata are not yet publicly disclosed, though its recent activity suggests impulsive deployment. The absence of derogatory entries on blocklists highlights the evasive nature of this infrastructure, warranting immediate scrutiny. The combination of a high-reputation registrar, SSL certification, and low detection rate creates a deceptive facade designed to bypass traditional security measures. As of this advisory, protl-project.pages.dev is classified as an active threat under investigation. Immediate containment measures include network-level blocking of the domain and IP address, alongside notifying the hosting provider (Cloudflare) for expedited takedown. Users are advised to avoid interaction with the domain and verify any project-related links through official channels. The residual risk remains elevated due to the domain’s current evasion tactics and the potential for rapid infrastructure shifts. Continuous monitoring for related domains and IPs is critical to disrupt this operation before further financial harm occurs. Safety guidance includes implementing allowlists for cryptocurrency-related domains and enabling wallet-level transaction confirmations to mitigate unauthorized transfers.