wallet--slushi--cdn[.]pages[.]dev

This domain, wallet--slushi--cdn.pages.dev, is identified as a crypto drainer phishing site designed to compromise cryptocurrency wallets by executing unauthorized transactions. Analysis indicates the infrastructure mimics legitimate wallet services or decentralized application interfaces, likely deploying malicious JavaScript to siphon funds upon user interaction. No direct brand impersonation is evident, but the domain naming convention suggests an attempt to deceive users into believing it is affiliated with a legitimate service, potentially leveraging typosquatting or obfuscation techniques. Infrastructure analysis reveals the domain was registered on October 27, 2025, through Cloudflare, Inc., and resolves to the IP address 172.66.46.236, hosted on AS13335. Google Safe Browsing flags this domain as phishing, and it appears on one security blocklist. VirusTotal reports 12 out of 95 security vendors detect the domain as malicious, with detections spanning categories such as phishing, fraud, and crypto-related threats. The SSL certificate is issued by Google Trust Services (WE1), a common practice among threat actors to lend superficial legitimacy to phishing pages. As of the latest assessment, the domain has been taken offline, likely due to enforcement actions by the hosting provider or security teams. The page title, 'Suspected phishing site | Cloudflare,' further corroborates its malicious classification. Despite its current offline status, residual risk persists due to potential re-registration or migration of the phishing kit to alternative domains. Users are advised to verify wallet addresses independently, avoid interacting with unsolicited links, and monitor transaction histories for unauthorized activity. Organizations should update blocklists to include this domain and its associated indicators of compromise.