crypto-onchain[.]pages[.]dev

This domain, crypto-onchain.pages.dev, is flagged as a crypto drainer phishing operation designed to compromise cryptocurrency wallet credentials and execute unauthorized transactions. Analysis indicates the site employs no overt brand impersonation but leverages decentralized finance (DeFi) themes, as evidenced by the page title 'Decentralization,' to lure victims into interacting with malicious smart contract interfaces. The infrastructure shows no direct affiliation with known drainer kits such as Angel Drainer or Inferno Drainer, though generic wallet-draining scripts are likely embedded in the frontend code. Infrastructure analysis reveals multiple technical indicators of malicious intent. The domain, created on April 29, 2026, resolves to the IP address 188.114.97.3 and is registered through Cloudflare, Inc. Security vendors on VirusTotal flag the domain at a 13/95 detection rate, while it appears on two independent security blocklists. The site employs Let’s Encrypt SSL certificates, Node.js, Vue.js, and Nuxt.js for dynamic content delivery, alongside Cloudflare’s CDN and HTTP/3 for performance and obfuscation. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a lag in detection rather than benign status. As of the latest assessment, crypto-onchain.pages.dev has been taken offline, likely in response to automated takedown requests or registrar enforcement. Despite its inactive status, residual risk persists due to potential DNS cache retention, mirrored instances, or re-registration under alternative TLDs. Users who interacted with the domain prior to takedown should immediately revoke wallet permissions, audit connected smart contracts, and monitor transaction histories for unauthorized activity. Security teams are advised to update blocklists with the domain, IP, and associated SSL certificate fingerprints to prevent future exposure.