iroon-wallet-account[.]pages[.]dev

This domain, iroon-wallet-account.pages.dev, is flagged as a crypto drainer designed to siphon cryptocurrency from victims by mimicking the legitimate Iron Wallet platform. The site presents itself as a secure crypto management and exchange access portal, using the brand name Iron® Wallet in its page title to deceive users. Crypto drainers operate by tricking victims into connecting their wallets to malicious smart contracts, which then execute unauthorized transactions, draining funds without consent. Given the irreversible nature of blockchain transactions, victims face permanent financial loss with no recourse for recovery. Analysis indicates the domain was registered on April 6, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3. Despite its recent creation, the domain has already been added to one security blocklist, though it remains undetected by antivirus engines, with a VirusTotal score of 0/95. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious domains to appear legitimate. Infrastructure analysis reveals the domain leverages Cloudflare’s hosting services, a tactic frequently observed in phishing campaigns to obscure the true origin of the threat. If a user has visited iroon-wallet-account.pages.dev or interacted with its content, immediate action is required. First, disconnect any connected wallets from the site and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Next, scan the device for malware to ensure no additional compromise has occurred. Users should also monitor their cryptocurrency wallets for unauthorized transactions and consider transferring remaining funds to a new, secure wallet. Given the domain’s active status and lack of detection on major security platforms, caution is advised when encountering any communication or links associated with Iron Wallet or similar crypto services.