qudefi-ia[.]pages[.]dev

The domain qudefi-ia.pages.dev is provisioned through Cloudflare Pages and is currently classified as an active crypto drainer with an elevated risk rating. Detection telemetry shows that nine out of ninety‑one VirusTotal security vendors have flagged the domain, indicating a non‑trivial level of malicious activity. Independent blocklist aggregators have listed the domain on three separate security blocklists, and it is explicitly blocked by the PhishDestroy, MetaMask, and SEAL filtering solutions, confirming that multiple defensive products recognize it as hostile.

No additional intelligence such as IP address, ASN, or SSL certificate details has been disclosed, and the page title or content has not been publicly analyzed. The combination of hosting on a reputable CDN, limited detection coverage, and inclusion on specialized blocklists suggests the operator is leveraging the anonymity of Cloudflare Pages to host a payload that attempts to intercept or redirect cryptocurrency transactions, typical of crypto‑drainer campaigns. Defenders should prioritize adding qudefi-ia.pages.dev to URL filtering and DNS block policies across enterprise gateways.

Continuous monitoring of DNS query logs for this FQDN is advised, as is the deployment of endpoint protection that can intercept wallet‑related API calls. Where feasible, security teams should submit the domain to sandbox environments to obtain dynamic behavioral indicators, and update threat intelligence feeds to propagate the observed detection counts. Given the active status and elevated risk, immediate enforcement of blocklist rules and heightened alerting on any attempted connections to this domain are recommended.