sdfhsdfhsdfh[.]pages[.]dev

PhishDestroy has flagged sdfhsdfhsdfh.pages.dev as an active crypto drainer phishing domain under investigation. This site masquerades as a legitimate service to trick users into connecting crypto wallets, enabling unauthorized fund transfers to attacker-controlled addresses.

This domain was registered via Cloudflare, Inc., resolving to IP 172.66.44.245 and operates under a Google Trust Services SSL certificate. VirusTotal currently rates it with 0/95 detections, indicating it remains undetected by most security engines. The domain leverages Cloudflare Pages for hosting, a tactic often used to evade traditional blocklists due to the platform’s legitimate infrastructure.

To mitigate exposure, users should avoid interacting with sdfhsdfhsdfh.pages.dev and block the domain at the network level. Organizations should update firewall rules to block 172.66.44.245 and flag the domain across email and web gateways. If a wallet connection was made, disconnect immediately, revoke permissions via blockchain explorers, and transfer remaining assets to a new wallet. Report the domain to threat intelligence platforms and security vendors to increase detection coverage.