faq-iron-wallet-en-us[.]pages[.]dev

This domain, faq-iron-wallet-en-us.pages.dev, is flagged as an active crypto drainer with a high risk level. Analysis confirms it is a verified phishing site targeting cryptocurrency wallet credentials. The domain was created on April 4, 2026, and remains active as of July 12, 2026. Infrastructure is hosted via Cloudflare, Inc., resolving to IP 188.114.97.3, with nameservers abdullah.ns.cloudflare.com and lindsey.ns.cloudflare.com. The page title claims to represent 'Iron Wallet — Secure and Reliable Cryptocurrency Wallet,' a known lure for wallet seed-phishing scams. SSL is issued by Google Trust Services (WE1), and the site uses HSTS, Cloudflare, and HTTP/3 technologies. VirusTotal shows 3 out of 94 security vendors flagging the domain, and it appears on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score is 0/100, indicating high risk. HTTP status is 403, suggesting the server is configured to block direct access or content delivery is restricted. The exact page content has not been visually analysed, but the scam type is classified as wallet or seed phishing, meaning visitors are likely tricked into entering private keys or recovery phrases. Defenders should block this domain immediately at network and email gateways, add it to blocklists, and monitor for related infrastructure changes. Users should be warned not to visit the site or provide any personal information. Uncertainty remains about the full scale of the operation, but the technical evidence strongly supports its malicious intent.