signup-sends[.]pages[.]dev

This domain, signup-sends.pages.dev, is identified as an active crypto drainer phishing endpoint designed to compromise digital wallet credentials and exfiltrate cryptocurrency assets. Analysis of page content and infrastructure reveals characteristics consistent with known drainer kits, including the absence of legitimate brand affiliation and the presence of wallet connection prompts typical of credential harvesting operations. The site employs no visible branding, suggesting a generic or opportunistic attack vector rather than targeted impersonation of a specific platform or service. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain resolves to IP address 172.66.44.147, hosted on Cloudflare's network (AS13335) with an SSL certificate issued by Google Trust Services (WE1). The domain was registered on October 10, 2025, through Cloudflare, Inc., and is currently flagged by 2 out of 95 security vendors on VirusTotal. The endpoint appears on five distinct security blocklists, including real-time transaction monitoring systems, and is actively blocked by multiple wallet security extensions. The page title 'Send' aligns with common phishing nomenclature used to mimic legitimate transaction interfaces. Current status remains active as of this assessment, with no evidence of takedown or mitigation. The domain continues to resolve and serve content, maintaining its threat posture. Response actions by security providers include widespread blocklisting and active warnings in browser-based wallet interfaces. Despite these measures, residual risk persists due to the domain's continued accessibility and the potential for undetected variants or redirects. Users are advised to verify wallet addresses through official channels, employ hardware-based transaction signing, and cross-reference domain reputation using multiple threat intelligence sources before interacting with any cryptocurrency-related interface.