on-call-crypto-help[.]pages[.]dev

This domain, on-call-crypto-help.pages.dev, is flagged as a crypto-focused phishing operation designed to trick users into disclosing wallet credentials or recovery phrases. Analysis indicates the site likely functions as a crypto drainer, where victims unknowingly authorize transactions that empty their digital asset holdings. The threat targets users seeking urgent cryptocurrency support, leveraging urgency and technical jargon to bypass skepticism. Infrastructure analysis reveals multiple red flags confirming its malicious nature. The domain was registered on March 28, 2026, an impossible future date suggesting fraudulent registration practices. It resolves to IP address 172.66.46.230 and is hosted through Cloudflare Pages, a common platform for rapid phishing deployment. VirusTotal shows 0 detections out of 95 engines, indicating the site is newly launched and not yet widely flagged. Despite this, it appears on one security blocklist, and its SSL certificate is issued by Google Trust Services, a legitimate provider often abused by threat actors. If you visited on-call-crypto-help.pages.dev, immediate action is required to mitigate risk. Disconnect the device from the internet to prevent ongoing data exfiltration. Revoke any wallet permissions granted to unknown dApps or contracts using blockchain explorers. Rotate all cryptocurrency wallet recovery phrases and private keys, as these may have been compromised. Monitor connected accounts for unauthorized transactions and report the domain to relevant security teams for further investigation. Users should also check browser extensions for unauthorized additions and scan devices for malware using updated security tools.