wolf-machine-wallet-portal[.]pages[.]dev

This domain, wolf-machine-wallet-portal.pages.dev, is actively flagged as a high-risk crypto drainer targeting users of a wallet service, as indicated by its page title 'WOLF Wallet ✨ Creation.' Infrastructure analysis reveals the domain is hosted on Cloudflare, resolving to IP 172.66.47.169 (AS13335, Cloudflare, Inc., located in CA). The domain was registered on March 26, 2026, through Cloudflare Registrar and employs HSTS, Cloudflare CDN, and HTTP/3 technologies. It is currently active, with a trust score of 0/100 and a single security blocklist entry. Google Safe Browsing classifies the domain under 'SOCIAL_ENGINEERING,' and six of 94 security vendors on VirusTotal have flagged it as malicious. The SSL certificate is issued by Google Trust Services (WE1), and the domain uses Cloudflare nameservers (gail.ns.cloudflare.com, lloyd.ns.cloudflare.com). The exact content and functionality of the site remain unanalyzed, but the scam type is confirmed as wallet/seed phishing, consistent with crypto drainer activity. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where cryptocurrency-related services are accessed. Monitoring for related domains using similar naming conventions (e.g., 'wallet,' 'portal,' or 'creation') or shared infrastructure (Cloudflare Pages, identical nameservers) may help identify additional threats. Given the domain's active status and low detection rate, automated alerts for new subdomains under *.pages.dev with similar characteristics may improve early detection.