dop-in[.]pages[.]dev

This domain is identified as a crypto wallet drainer, a specialized form of credential theft targeting cryptocurrency holders. The site mimics legitimate decentralized platforms, tricking users into connecting their wallets to malicious smart contracts that automatically siphon funds without authorization. Analysis of the page structure reveals the use of crypto-js, a library commonly exploited in drainer scripts to interact with blockchain transactions and execute unauthorized transfers. The presence of SweetAlert2 further suggests an attempt to create convincing pop-up confirmations that lower user vigilance during the attack sequence. Infrastructure analysis provides concrete evidence of malicious intent. The domain dop-in.pages.dev was registered on April 07, 2024, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. Security vendors on VirusTotal flagged this domain at a rate of 6/95, indicating moderate but consistent detection across multiple engines. The domain appears on one security blocklist, and its trust score from Gridinsoft is 0/100, reinforcing its classification as high-risk. The SSL certificate, issued by Google Trust Services, does not mitigate the threat, as legitimate certificates are frequently abused in phishing operations to create a false sense of security. Users who visited dop-in.pages.dev or interacted with its content should take immediate action to secure their assets. Disconnect any wallets linked to the site and revoke permissions for all suspicious smart contracts using a blockchain explorer. Scan connected devices for malware, as drainer scripts may deploy additional payloads. Monitor wallet activity for unauthorized transactions and consider migrating funds to a new wallet if exposure is confirmed. Report the domain to relevant security communities to assist in broader threat mitigation efforts.