crypxe-wallet[.]pages[.]dev

This domain, crypxe-wallet.pages.dev, is flagged as an active crypto drainer targeting users through a fake USDT wallet interface. Registered on April 5, 2026, via Cloudflare, the domain resolves to IP 188.114.96.3, hosted under Cloudflare's infrastructure in Canada. The page title, 'Crypxe | Gasless USDT Wallet,' suggests an attempt to impersonate a legitimate cryptocurrency wallet service, though no specific brand impersonation is confirmed beyond the generic wallet theme. Infrastructure analysis reveals the use of Cloudflare nameservers (journey.ns.cloudflare.com, leif.ns.cloudflare.com) and a Let's Encrypt SSL certificate (E7), which are common among both legitimate and malicious domains. As of July 12, 2026, the domain remains active with an HTTP 200 status, indicating it is operational. It appears on one security blocklist and is blocked by PhishDestroy. Gridinsoft assigns a trust score of 0/100, further supporting its classification as malicious. While VirusTotal shows minimal detection (1 of 94 vendors), this does not diminish the domain's risk, as crypto drainers often evade initial scans through obfuscation or rapid infrastructure changes. Defenders should treat this domain as high-risk. Indicators include its recent registration, association with Cloudflare's hosting (a common tactic for anonymity), and its explicit classification as a wallet/seed phishing scam. No confirmed victim reports or transaction patterns are available at this time, but the domain's structure aligns with known crypto drainer campaigns. Network-level blocking and monitoring of associated IP (188.114.96.3) and SSL certificate (Let's Encrypt E7) are recommended for mitigation.