lazarusdrainer[.]pages[.]dev

Analysis of lazarusdrainer.pages.dev shows an active website returning HTTP 200 and presenting the page title "Crypto Drainer Agency". The domain was registered on 21 April 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.44.207 located in Canada. DNS is served by arushi.ns.cloudflare.com and jack.ns.cloudflare.com. The site uses a Google Trust Services / WE1 TLS certificate, indicating a valid HTTPS connection, but the certificate does not mitigate the malicious purpose. The page is classified as a "Crypto Drainer" scam, consistent with the observed title and the listing on a single security blocklist (PhishDestroy). Gridinsoft assigns a trust score of 0/100, and the domain appears on one blocklist, confirming that threat‑intel feeds consider it malicious. No additional content has been publicly disclosed, and the site has not been reported by any other scanning service beyond the listed blocklist. The lack of detections from VirusTotal does not imply safety, and the short age of the domain limits the amount of historical telemetry. Defenders should block or monitor DNS resolution to 172.66.44.207, enforce TLS inspection to capture any credential or wallet data, and add the domain to internal blacklist feeds. Continued observation is recommended to capture any payload changes or credential‑harvesting pages that may appear as the campaign evolves.