polkadotnews[.]pages[.]dev

The domain polkadotnews.pages.dev has been confirmed as a cryptocurrency drainer phishing site targeting users through fraudulent wallet interactions. Analysis indicates the infrastructure was designed to siphon digital assets by impersonating legitimate cryptocurrency news or service platforms. The domain is currently offline, though prior activity suggests it was actively used for malicious financial exploitation. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 21, 2026, and resolved to the IPv6 address 2606:4700:310c::ac42:2d22, hosted within the United States under AS13335 (Cloudflare, Inc.). Security vendors flagged the domain with 11 detections out of 95 on VirusTotal, while Google Safe Browsing and at least one additional security blocklist classified it as phishing. The SSL certificate, issued by Google Trust Services (WE1), aligns with Cloudflare’s standard deployment but does not mitigate the domain’s malicious intent. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its deceptive nature. Current status indicates the domain has been taken offline, likely due to enforcement actions or infrastructure suspension. However, users who may have interacted with the site should immediately revoke any connected wallet permissions and monitor accounts for unauthorized transactions. Organizations are advised to update blocklists with the domain and associated IP address, while end-users should verify website authenticity before engaging with cryptocurrency-related platforms. Continuous monitoring of similar domains registered under Cloudflare Pages is recommended to preempt further abuse of this infrastructure.