appwallet-live[.]pages[.]dev

This domain, appwallet-live.pages.dev, is currently active and has been classified as a crypto‑drainer infrastructure. VirusTotal records indicate that 12 of 91 security vendors have flagged the domain, suggesting that a minority of scanners have identified malicious characteristics, while the majority have not raised an alert. The domain is hosted behind Cloudflare, Inc., as evidenced by the registrar information and the authoritative name servers maxim.ns.cloudflare.com and melissa.ns.cloudflare.com. DNS resolution points to the IP address 172.66.45.3, which is owned by Cloudflare and therefore shares infrastructure with many unrelated legitimate services, complicating attribution based solely on IP reputation.

The domain appears on a single public blocklist and is specifically blocked by the PhishDestroy service, confirming that at least one independent threat‑intelligence feed considers it malicious. Defenders should treat any outbound connections to appwallet-live.pages.dev as high‑confidence indicators of compromise related to cryptocurrency theft attempts. Recommended mitigations include adding the domain to DNS‑based deny lists, configuring web‑proxy rules to block HTTP(S) traffic to the host, and monitoring network logs for DNS queries or TLS handshakes to the IP 172.66.45.3.

Because the hosting provider is a large CDN, additional context such as request patterns, user‑agent strings, and payload signatures should be correlated to reduce false positives. Continuous re‑evaluation is advised, as the detection count on VirusTotal may evolve and additional blocklists may surface. Organizations that handle cryptocurrency assets should prioritize this indicator in their threat‑hunting playbooks and ensure that endpoint protection solutions are updated to recognize the 12 vendor detections associated with this domain.