token-oriviumio[.]pages[.]dev

This domain is flagged as a high-risk crypto wallet drainer, a specialized phishing threat designed to siphon cryptocurrency assets from victims' wallets upon interaction. Analysis indicates the site employs deceptive transaction prompts to trigger malicious smart contracts, draining funds without explicit authorization. The threat targets users of decentralized finance platforms, mimicking legitimate wallet interfaces to exploit trust and urgency. Infrastructure analysis reveals the domain token-oriviumio.pages.dev is hosted on Cloudflare's content delivery network, resolving to IP address 172.66.47.137 (AS13335, United States). The domain is registered through Cloudflare, Inc., and uses an SSL certificate issued by Google Trust Services (WE1). Despite its active status and detection by three security blocklists, the domain currently shows 0/95 detections on VirusTotal, suggesting evasion of traditional signature-based detection methods. The lack of prior flagging may indicate the use of obfuscation techniques or newly deployed infrastructure. Mitigation against this crypto wallet drainer requires heightened vigilance during wallet interactions. Users should verify domain authenticity before connecting wallets, cross-referencing official project URLs and avoiding links from unsolicited messages. Enabling transaction simulation tools can help preview smart contract interactions, while hardware wallets or multi-signature setups provide additional protection against unauthorized transfers. Network-level blocking of the domain and its resolving IP (172.66.47.137) is recommended for enterprise environments, alongside monitoring for similar Cloudflare-hosted subdomains under the pages.dev namespace.