coldwallet-mockup[.]pages[.]dev

PhishDestroy identifies coldwallet-mockup.pages.dev as an active crypto drainer domain linked to seed 8df018. Current status indicates the domain remains under investigation as a distributing fraudulent asset intended to drain cryptocurrency wallets. Threat intelligence suggests this infrastructure is designed to mimic legitimate wallet interfaces to deceive users into connecting compromised wallets. No confirmed association with a specific cryptocurrency brand has been established at this time, though the UI elements closely resemble cold wallet interfaces.

This domain was flagged by 0 of 95 VirusTotal vendors as of latest scan. It is registered through Cloudflare, Inc., resolving to IP 172.66.44.67. The SSL certificate is issued by Google Trust Services, indicating HTTPS enforcement. While trust indicators imply infrastructure legitimacy, the absence of detection belies its malicious intent. The domain is hosted on Cloudflare Pages, a legitimate platform often abused for rapid deployment of phishing and drainer campaigns. The lack of current detection underscores the evasive nature of crypto drainers that rely on real-time obfuscation and wallet interaction logic rather than traditional malware signatures.

The campaign is confirmed active as of seed 8df018. Given the zero detection rate and SSL certificate from a trusted authority, organizations and users must treat this domain as a critical threat. All traffic to coldwallet-mockup.pages.dev should be blocked at network and endpoint levels. Users are advised to verify wallet URLs via official sources, enable transaction simulation tools when available, and use hardware wallet isolation for sensitive operations. Security teams should deploy DNS sinkholing and update threat intelligence feeds with the IP and domain indicators. Immediate hardening of browser security policies and user awareness training on crypto drainer tactics are strongly recommended to prevent financial loss.