dripctofarm[.]pages[.]dev

This domain, dripctofarm.pages.dev, functions as a crypto drainer phishing site designed to exploit users interacting with decentralized finance (DeFi) platforms. The site likely employs social engineering tactics to trick victims into connecting cryptocurrency wallets, after which malicious scripts automatically initiate unauthorized transactions, draining funds without consent. The presence of SweetAlert2 and crypto-js in the detected technologies suggests the use of interactive pop-ups and cryptographic operations, which are commonly abused in wallet-draining attacks. The domain’s page title, 'DRIP,' may be intended to mimic legitimate token distribution or airdrop services, further increasing its deceptive appeal to targets familiar with crypto-related promotions. Analysis of technical indicators reveals multiple red flags. The domain is flagged by 12 out of 95 security vendors on VirusTotal, indicating broad consensus on its malicious nature. It was registered on April 24, 2026, through Cloudflare, Inc., a registrar frequently used for rapid deployment of phishing infrastructure. The domain resolves to the IP address 188.114.97.3, which is part of a network known for hosting transient malicious sites. Additionally, it appears on three security blocklists and is actively blocked by wallet security providers, reinforcing its classification as a high-risk threat. The SSL certificate issued by Google Trust Services and the use of Cloudflare’s content delivery network provide a veneer of legitimacy, complicating detection for less technical users. Users who visited dripctofarm.pages.dev should immediately revoke any wallet connections made to the site. This can be done through the connected applications or permissions section of their wallet interface. All active sessions should be terminated, and any suspicious transactions reviewed for unauthorized activity. If funds were transferred, victims should report the incident to relevant blockchain analytics platforms and law enforcement with jurisdiction over cybercrime. It is also recommended to scan the device used to access the site for malware, as some crypto drainers deploy additional payloads. Future precautions include verifying domain authenticity before interacting with DeFi platforms and using browser-based security extensions that block known phishing domains.