transitswaps-1se[.]pages[.]dev

The domain transitswaps-1se.pages.dev is identified as a crypto wallet drainer, a specialized phishing threat designed to siphon cryptocurrency assets by deceiving users into connecting their wallets. As of the latest analysis, the domain has been taken offline, though it previously resolved to the IP address 172.66.44.98. The page impersonated legitimate wallet services, presenting itself under the title 'Wallets online' to lure victims into interacting with malicious smart contracts or disclosing private keys. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., with an anomalous creation date of April 29, 2026, suggesting potential domain spoofing or registry manipulation. The domain is associated with a Google Trust Services SSL certificate, adding a veneer of legitimacy. Detection metrics indicate minimal vendor awareness, with 0 of 95 VirusTotal security engines flagging the domain at the time of assessment. However, it appears on three security blocklists, and its trust score from Gridinsoft is 0 out of 100. Technologies detected on the site include Bootstrap, React, Gatsby, jsDelivr, jQuery, HSTS, EmailJS, and cdnjs, which are consistent with modern web applications but do not preclude malicious intent. The current offline status of transitswaps-1se.pages.dev reduces immediate risk, though historical exposure may persist for users who interacted with the domain prior to its takedown. Organizations and individuals are advised to block the domain and its associated IP address (172.66.44.98) at the network level. Users should verify wallet connections and revoke access to any suspicious smart contracts. Monitoring for similar domains registered through Cloudflare or resolving to the same IP range is recommended, as threat actors may deploy new infrastructure. Cryptocurrency holders are urged to enable hardware wallet protections and multi-factor authentication for all sensitive transactions.