halrecovery[.]pages[.]dev

This domain, halrecovery.pages.dev, poses a high-risk credential theft and crypto asset compromise threat by impersonating Halborn, a legitimate blockchain security firm. The site mimics Halborn’s branding, including its page title, 'Halborn Blockchain Security Firm: Ethical Hackers, Infosec & Pen Tests,' to deceive users into disclosing wallet credentials, private keys, or executing malicious smart contract interactions. Such impersonation tactics are commonly used to facilitate crypto drainer attacks, where victims unknowingly authorize transactions that transfer funds to attacker-controlled wallets. The domain’s infrastructure and content are designed to exploit trust in established security providers, increasing the likelihood of successful social engineering against cryptocurrency holders and developers. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain resolves to IP address 188.114.96.3 and is flagged by 12 out of 95 security vendors on VirusTotal, with Google Safe Browsing specifically categorizing it as 'SOCIAL_ENGINEERING.' It appears on four security blocklists and is actively blocked by tools such as MetaMask and ScamSniffer, further confirming its association with fraudulent activity. Registered through Cloudflare on April 30, 2026, the domain leverages Cloudflare’s infrastructure, including HSTS and HTTP/3, to appear legitimate while obscuring its true origin. The SSL certificate is issued by Google Trust Services, adding a superficial layer of trust. Despite its technical sophistication, the domain’s Gridinsoft trust score of 0/100 underscores its high-risk classification. Users who visited halrecovery.pages.dev should assume potential exposure to credential theft or crypto asset compromise. Immediate actions include revoking any smart contract approvals or wallet connections made while on the site, using tools like wallet transaction revocation services. All credentials, private keys, or recovery phrases entered on the site should be considered compromised and rotated immediately. Affected users should monitor their wallets for unauthorized transactions and report the domain to relevant security communities or blocklist providers. If financial loss occurred, victims should file reports with local cybercrime authorities and provide transaction hashes for further investigation. Future precautions include verifying domain authenticity via official channels before interacting with any security-related services.