wallet-webview-dist[.]pages[.]dev

This domain, wallet-webview-dist.pages.dev, is under investigation for potential crypto drainer activity as of July 29, 2026. Infrastructure analysis reveals it is hosted through Cloudflare Pages, with nameservers dion.ns.cloudflare.com and miki.ns.cloudflare.com, and resolves to the IP address 172.66.45.25. The domain appears on one security blocklist, specifically PhishDestroy, though it is not currently flagged by any of the 91 vendors that scanned it on VirusTotal. The absence of detections in VirusTotal does not confirm safety, as scanning coverage and detection logic vary across vendors.

The registrar and hosting provider, Cloudflare, Inc., is a common choice for both legitimate and malicious infrastructure due to its accessibility and protective features. While the domain is active, no specific brand impersonation, phishing kit, or page content has been confirmed in available data. Defenders should treat this domain as suspicious based on its presence on a security blocklist and its association with crypto drainer activity.

Immediate actions include monitoring network traffic for connections to this domain, blocking it at the DNS or proxy level, and investigating any endpoints that interact with it. Further analysis of HTTP headers, SSL certificates, and page content is recommended to determine the exact nature of the threat. Given the lack of widespread detection, defenders should not rely solely on vendor flags and should conduct independent validation.