santatokenclaimreward[.]pages[.]dev

Analysis indicates that santatokenclaimreward.pages.dev is actively used as a crypto‑drainer infrastructure. The domain was registered on January 07 2026 and is hosted on Cloudflare Pages, resolving to the IP address 172.66.47.119, which belongs to Cloudflare’s edge network. VirusTotal records show that 10 of 91 scanned security vendors flag the domain, providing a multi‑vendor indication of malicious behavior. The domain is listed on a security blocklist and is specifically blocked by PhishDestroy, reinforcing the assessment of active abuse.

The risk rating is elevated and the operational status is marked as active. The short age of the domain (approximately seven months at the time of this report) combined with its deployment on a legitimate content‑delivery platform suggests an attempt to leverage trusted hosting to evade simple reputation checks. No additional intelligence such as page title, SSL certificate details, or observed HTTP responses is currently available, leaving the exact phishing or credential‑harvesting mechanisms unconfirmed. Nevertheless, the convergence of vendor detections, blocklist inclusion, and the crypto‑drainer classification points to a high likelihood that the site is employed to lure victims into transferring cryptocurrency to addresses controlled by threat actors.

Defenders should prioritize immediate blocking of the domain at network perimeter and DNS filtering layers. Monitoring traffic to the associated Cloudflare edge IP (172.66.47.119) is advisable, as the same infrastructure may host other malicious assets. Continuous re‑scanning with sandbox and URL reputation services is recommended to capture any evolution of the payload or site content. Organizations should also educate users about unsolicited crypto‑claim offers and reinforce policies that prohibit unsolicited transfers to unknown wallets.