defi-6w3w[.]pages[.]dev

PhishDestroy identifies defi-6w3w.pages.dev as an active crypto drainer site under investigation, leveraging Cloudflare Pages to host malicious scripts designed to siphon cryptocurrency from unwitting users. This domain impersonates decentralized finance (DeFi) platforms, a high-value target for threat actors seeking to exploit the anonymity and irreversible nature of crypto transactions. The drainer kit embedded within the site is engineered to intercept wallet connections and silently approve token transfer permissions, redirecting funds to attacker-controlled addresses without user interaction. Based on seed b6e1b2, this campaign appears to be part of a broader effort to target users of emerging DeFi protocols, where trust in platform legitimacy is often exploited by cybercriminals.

This domain resolves to IP 172.66.45.30 and is registered through Cloudflare, Inc., which provides anonymity and operational resilience to threat actors. The SSL certificate, issued by Google Trust Services, adds a false veneer of legitimacy, while the 0/95 VirusTotal detection rate highlights the evasive nature of this threat. As of the latest analysis, defi-6w3w.pages.dev remains unflagged across major security platforms, underscoring the need for proactive threat intelligence. The domain’s recent creation date and lack of historical data suggest a rapidly deployed operation, further complicating detection efforts. Security researchers are advised to monitor this domain closely, as its infrastructure may be repurposed for additional attacks.

As of this report, defi-6w3w.pages.dev is classified as an active threat with a high potential for financial harm. While no immediate takedown actions have been confirmed, security teams are encouraged to block the domain at the network level and update threat intelligence feeds to include this indicator. Users interacting with DeFi platforms should verify URLs manually, enable transaction simulation tools, and revoke suspicious wallet permissions immediately. The risk remains elevated due to the domain’s evasive tactics and the irreversible nature of crypto drainer attacks. Remain vigilant—this threat is evolving, and further analysis is ongoing.