trasaksi10jt-20jtterepecayaclaimsekarngtunguapalagi[.]pages[.]dev

This domain, trasaksi10jt-20jtterepecayaclaimsekarngtunguapagi.pages.dev, is identified as a high-risk crypto drainer infrastructure designed to siphon cryptocurrency assets from victims through deceptive transaction prompts. Analysis indicates no direct brand impersonation; instead, the domain leverages urgency-driven language (e.g., "claim now") to trick users into executing malicious smart contracts or approving unauthorized wallet transactions. The absence of a known drainer kit signature suggests custom or obfuscated code, complicating attribution. The domain's structure and naming convention align with patterns observed in Southeast Asian-targeted crypto scams, particularly those exploiting localized financial terminology and time-sensitive offers. Infrastructure analysis reveals the following technical indicators: the domain was registered on July 31, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.47.176, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing domains leveraging legitimate CDN services. Google Safe Browsing explicitly flags the domain as phishing, while VirusTotal reports 18 detections out of 95 security vendors. The domain appears on one security blocklist (PhishDestroy) and is currently categorized with the page title "Suspected phishing site | Cloudflare." The unique seed identifier for this campaign is 50379e, which may assist in clustering related infrastructure. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, residual risk persists due to the transient nature of such infrastructure; threat actors frequently rotate domains and IPs to evade detection. Users who interacted with this domain prior to its takedown should immediately revoke any wallet approvals, check transaction histories for unauthorized activity, and monitor connected accounts for signs of compromise. Organizations are advised to block the domain, IP, and associated SSL certificate thumbprint in network security controls. Proactive measures include deploying wallet transaction simulation tools to detect drainer contract interactions and educating users on verifying domain authenticity before engaging with crypto-related prompts.