slush-wallet[.]pages[.]dev

Analysis of slush-wallet.pages.dev indicates a confirmed crypto drainer phishing operation, now offline as of July 23, 2026. The domain, registered on October 24, 2025, through Cloudflare, resolved to 172.66.44.99 (AS13335, Cloudflare, Inc., US) and was served via Cloudflare nameservers (ken.ns.cloudflare.com, liz.ns.cloudflare.com). At the time of assessment, the domain returned an HTTP 403 status with a page title explicitly labeled 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's automated detection systems flagged it prior to takedown. Thirteen of 95 security vendors on VirusTotal classified this domain as malicious, aligning with its presence on one security blocklist (PhishDestroy).

The domain employed HSTS and HTTP/3, typical of modern phishing infrastructure leveraging Cloudflare's security features to evade initial scrutiny. SSL certification was issued by Google Trust Services (WE1), a common but not inherently malicious provider. No specific brand impersonation or phishing kit details were identified in the available data, though the 'crypto drainer' classification is supported by the scam type designation. Defenders should treat this domain as a confirmed threat vector for cryptocurrency theft, particularly given its historical association with wallet-draining attacks.

The 403 status and Cloudflare's warning page indicate the domain is no longer serving active content, but residual DNS or cached records may persist. Recommended actions include blocking the domain and IP at network perimeter controls, monitoring for related subdomains or IP reuse under Cloudflare's ASN, and alerting users to potential exposure if this domain appeared in logs prior to takedown. Further investigation into associated wallet addresses or transaction patterns may yield additional indicators for crypto-specific defenses.