caldera2[.]pages[.]dev

This domain, caldera2.pages.dev, is under investigation for hosting a fake crypto drainer phishing page. Analysis indicates the site impersonates a cryptocurrency service under the title CALDERA DROP, designed to trick users into connecting wallets and siphoning funds. The threat type is classified as a crypto drainer, a high-risk attack vector targeting digital asset holders with malicious smart contract interactions. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 31, 2026, and currently resolves to the IP address 172.66.44.192. The site employs SSL encryption via Google Trust Services and utilizes technologies such as Vue.js, Smartsupp, HSTS, and HTTP/3. Despite its recent creation, the domain has already been flagged on 2 security blocklists, including PhishDestroy and ScamSniffer. Notably, VirusTotal reports 0 out of 95 detections, suggesting the threat remains undetected by most security vendors. The Gridinsoft trust score of 0/100 further corroborates its malicious nature. Mitigation steps for this specific threat include immediate blocking of the domain and its resolving IP (172.66.44.192) at the network perimeter. Organizations should update endpoint protection rules to flag interactions with crypto drainer infrastructure, particularly those using Cloudflare-hosted pages. Users should be advised to verify wallet connection prompts independently and avoid interacting with unsolicited cryptocurrency service offers. Security teams are recommended to monitor for additional domains using the same registrar or IP range, as this may indicate a broader campaign.