white-net-b75[.]cf-eb0dgs6f[.]workers[.]dev

This domain is flagged as a high-risk crypto wallet drainer, designed to siphon digital assets from unsuspecting users through deceptive transaction prompts or credential harvesting. Analysis indicates the threat type involves malicious JavaScript injections or fake wallet interfaces, commonly targeting decentralized finance (DeFi) platforms and cryptocurrency holders. The domain exhibits characteristics consistent with automated phishing kits, including obfuscated code and rapid deployment cycles. Infrastructure analysis reveals the domain white-net-b75.cf-eb0dgs6f.workers.dev is registered through Cloudflare, Inc., leveraging its Workers platform for hosting. It resolves to the IP address 104.21.70.10, associated with AS13335 (Cloudflare, Inc.) and geolocated in the United States. VirusTotal detection metrics report 3 out of 95 security vendors flagging the domain as malicious. The domain appears on three distinct security blocklists, including specialized cryptocurrency threat feeds. No creation date metadata is publicly available, but the domain remains actively resolving and serving malicious content as of the latest verification. Mitigation measures should focus on blocking the domain and its resolving IP at the network perimeter. Users are advised to verify wallet addresses via trusted sources before executing transactions and to employ browser-based wallet extensions with built-in phishing detection. Organizations should monitor for outbound connections to 104.21.70.10 and implement strict content security policies to prevent unauthorized script execution. Cryptocurrency holders are further cautioned against interacting with unsolicited links or pop-ups, particularly those mimicking legitimate wallet interfaces or transaction confirmations. Regular audits of browser extensions and wallet software are recommended to detect and remove unauthorized modifications.