eigen-claim-6ro[.]pages[.]dev

Analysis of eigen-claim-6ro.pages.dev indicates an active crypto drainer phishing infrastructure hosted on Cloudflare Pages. The domain was registered on June 11, 2026, and currently resolves to IP address 172.66.44.59. Security vendor detections on VirusTotal show 11 of 91 engines flagging the domain as malicious, with additional blocking by PhishDestroy, MetaMask, and SEAL. The domain appears on three security blocklists, reinforcing its classification as high-risk.

Infrastructure analysis reveals the domain is part of a broader pattern of abuse leveraging Cloudflare Pages for rapid deployment and evasion. The IP address 172.66.44.59 is associated with Cloudflare’s network, a common tactic to obscure hosting origins and complicate takedown efforts. No specific brand impersonation or page content analysis is available at this time, but the domain’s classification as a crypto drainer suggests it targets cryptocurrency wallet credentials or transaction approvals.

Defenders should prioritize blocking this domain at the DNS and network levels, particularly in environments where cryptocurrency transactions occur. Given its presence on multiple blocklists and detection by security vendors, organizations should treat this domain as confirmed malicious and monitor for related infrastructure using the same IP or registrar patterns. Further investigation into associated wallet addresses or transaction hashes may provide additional indicators of compromise.