contact-lobstr-wallet-support-d6h[.]pages[.]dev

This domain is flagged as an elevated-risk crypto_drainer, a threat category designed to siphon cryptocurrency assets from compromised wallets. Analysis indicates the domain targets users through deceptive wallet support interfaces, leveraging social engineering to execute unauthorized transactions. The infrastructure and naming convention align with known crypto_drainer campaigns, where victims are tricked into approving malicious smart contracts or revealing private keys. Infrastructure analysis reveals the domain contact-lobstr-wallet-support-d6h.pages.dev was registered on April 01, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.97.3. It is currently offline but was previously detected by 9 out of 95 security vendors on VirusTotal. The domain appears on three security blocklists and is explicitly blocked by MetaMask, PhishDestroy, and SEAL. The Gridinsoft trust score for this domain is 0/100, indicating no legitimate use. Technologies detected include HSTS, Cloudflare CDN, and HTTP/3, while the SSL certificate is issued by Google Trust Services. The page title, 'My Simple Web Page,' is a common obfuscation tactic to evade automated detection systems. Mitigation against crypto_drainer threats requires strict adherence to wallet security protocols. Users should never interact with domains purporting to offer wallet support unless verified through official channels. Wallet software should be configured to reject unsolicited transaction requests, and hardware wallets should be used for high-value assets to prevent remote exploitation. Network-level protections, such as DNS filtering or enterprise-grade security gateways, should block domains resolving to 188.114.97.3 or those registered via Cloudflare with recent creation dates. Organizations should monitor for outbound connections to newly registered domains with cryptocurrency-related keywords, as these are high-risk indicators for crypto_drainer activity.