safenetgateway[.]pages[.]dev

This domain is flagged as a high-risk crypto credential theft operation designed to harvest wallet credentials and recovery phrases. Analysis indicates the site employs infrastructure commonly associated with cryptocurrency wallet drainers, a threat type that targets users of decentralized finance platforms and self-custody wallets. The domain's primary objective appears to be the unauthorized extraction of private keys or seed phrases through deceptive interfaces mimicking legitimate wallet services. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain safenetgateway.pages.dev was registered on August 21, 2025, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious sites leveraging legitimate CDN infrastructure. Security vendors have detected this domain with a VirusTotal score of 10/95, indicating cross-industry recognition of its malicious nature. The domain appears on four security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura, further corroborating its classification as a credential theft operation. The page title, 'Suspected phishing site | Cloudflare,' suggests the hosting provider has already identified and flagged the content. Mitigation against crypto credential theft requires immediate action from both users and infrastructure providers. Users who may have interacted with safenetgateway.pages.dev should assume their wallet credentials are compromised and immediately transfer assets to a new, secure wallet using a clean device. Private keys or recovery phrases entered on this domain should be considered exposed and invalidated. Infrastructure providers are advised to enforce strict access controls on newly registered domains, particularly those leveraging CDN services for rapid deployment. Security teams should monitor for connections to 188.114.96.3 and domains with similar naming patterns, as these may indicate related credential theft campaigns. Proactive blocking of domains registered through Cloudflare with creation dates post-August 2025 and matching SSL certificate issuers can reduce exposure to this threat vector.