claim-runemilio[.]pages[.]dev

This domain, claim-runemilio.pages.dev, is flagged as an active crypto drainer site designed to siphon cryptocurrency from connected wallets. The page displays the title 'RUNEMILIO,' suggesting an attempt to impersonate or exploit a cryptocurrency-related brand or service. Analysis indicates the use of a drainer kit, likely targeting users through phishing lures such as fake airdrops, token claims, or wallet verification prompts. The domain infrastructure is structured to evade initial detection while facilitating unauthorized transactions from compromised wallets. Infrastructure analysis reveals the domain was registered on April 20, 2024, through Cloudflare, Inc., and resolves to the IP address 172.66.44.168, hosted on AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1). Despite its malicious intent, the domain currently shows 0 detections out of 95 engines on VirusTotal, indicating limited initial detection. However, it appears on 3 security blocklists and is proactively blocked by multiple threat intelligence feeds, including PhishDestroy, ScamSniffer, and Enkrypt. The domain's use of Cloudflare hosting further complicates takedown efforts due to the provider's distributed infrastructure. As of the latest assessment, claim-runemilio.pages.dev remains active and poses a high risk to users interacting with cryptocurrency wallets. Immediate response actions include adding the domain to internal blocklists, monitoring for related indicators of compromise (IOCs), and alerting users to avoid interaction. The lack of VirusTotal detections underscores the need for layered defenses, including real-time threat intelligence feeds and endpoint protection. Users are advised to verify domain authenticity before connecting wallets and to report any suspicious activity involving this domain to relevant security teams.