io-phomt-iqs-wallet[.]pages[.]dev

Analysis of the domain io-phomt-iqs-wallet.pages.dev confirms its classification as a crypto drainer phishing site, currently offline as of July 25, 2026. The domain, registered through Cloudflare, Inc. on February 21, 2026, resolves to the IP address 172.66.46.234, hosted on Cloudflare's infrastructure (AS13335). The SSL certificate is issued by Google Trust Services (WE1), and the domain employs HSTS and HTTP/3 technologies, typical of modern web hosting but also leveraged by malicious actors to lend legitimacy to phishing pages. The domain appears on one security blocklist and is flagged by 5 of 93 security vendors on VirusTotal, indicating moderate detection but not universal recognition.

The HTTP status returned is 403 (Forbidden), and the page title displayed is 'Suspected phishing site | Cloudflare,' suggesting that Cloudflare's internal systems have identified and mitigated the threat. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious nature. The scam type is explicitly identified as a crypto scam, aligning with the broader trend of cryptocurrency-related phishing campaigns targeting wallet credentials and private keys. Infrastructure analysis reveals the use of Cloudflare nameservers (adam.ns.cloudflare.com and ashley.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns.

While the domain is currently offline, defenders should treat any future resolution or reappearance of this domain as high-risk. Organizations are advised to block the domain and its associated IP (172.66.46.234) at the network level, update endpoint protection signatures, and monitor for related indicators of compromise. The exact content of the phishing page remains unanalyzed due to its offline status, but the available evidence strongly supports its classification as a crypto drainer.