business-for-zenvero-dje[.]pages[.]dev

This domain, business-for-zenvero-dje.pages.dev, is identified as a crypto wallet drainer phishing site designed to siphon cryptocurrency from victims by mimicking legitimate wallet interfaces. Analysis indicates the use of a known drainer kit, likely targeting users through deceptive prompts to connect wallets or input recovery phrases. No direct brand impersonation is evident, but the infrastructure aligns with common crypto-phishing tactics observed in recent campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP 172.66.44.56, hosted under Cloudflare, Inc. (AS13335) in the United States. It was registered on October 22, 2025, through Cloudflare’s registrar services. The domain is flagged by 17 out of 95 security vendors on VirusTotal, appears on 2 security blocklists, and is currently labeled as a suspected phishing site by the hosting provider. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites to appear legitimate. The domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. However, residual risk remains, as threat actors may re-deploy the same drainer kit under a new domain or infrastructure. Users who interacted with the site should immediately revoke wallet permissions, monitor for unauthorized transactions, and report the incident to relevant security platforms. Organizations are advised to block the domain and associated IP at the network level to prevent further exposure.