weblink-49z[.]pages[.]dev

This domain is flagged as a high-risk Binance brand impersonation site designed to deploy crypto drainer malware. Analysis indicates the infrastructure is actively targeting cryptocurrency users through fake decentralized finance (DeFi) protocol interfaces, as evidenced by the page title 'Defi – Protocol' and confirmed Binance impersonation tactics. Infrastructure analysis reveals the following technical indicators: the domain weblink-49z.pages.dev resolves to IP address 188.114.97.3 (AS13335 Cloudflare, Inc., US-based), was registered on October 17, 2023 through Cloudflare, Inc., and is currently active. Security vendors on VirusTotal flag this domain at 11/95 detection ratio, while it appears on two independent security blocklists (PhishDestroy and ScamSniffer). The SSL certificate is issued by Google Trust Services (WE1), a common pattern observed in malicious Cloudflare-hosted phishing infrastructure. Organizations and users should implement the following mitigation steps specific to crypto drainer threats: immediately block the domain and associated IP at network perimeter devices, revoke any active sessions with the domain, and conduct a wallet security audit to check for unauthorized smart contract approvals. Users who interacted with this domain should assume wallet compromise and transfer assets to a new secure wallet, followed by a full system scan for malware. Security teams should monitor for similar Cloudflare Pages subdomains using the pattern 'weblink-XXz.pages.dev' and prioritize takedown requests for domains matching this infrastructure fingerprint (seed: ca6fd9).