ethdrainer[.]pages[.]dev

This domain, ethdrainer.pages.dev, is currently under investigation for hosting a crypto drainer phishing operation impersonating Cloudflare infrastructure. Registered on May 12, 2025, through Cloudflare, Inc., the domain resolves to 172.66.44.252 within AS13335 and presents a Cloudflare-branded error page with the title 'Worker threw exception | ethdrainer.pages.dev | Cloudflare.' The HTTP status code 500 suggests a server-side failure, which may indicate either a misconfigured phishing kit or an attempt to evade automated detection systems. Analysis of the domain's infrastructure reveals the use of Cloudflare nameservers (kenia.ns.cloudflare.com and apollo.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The presence of HSTS and HTTP/3 further aligns with legitimate Cloudflare-hosted services, complicating differentiation between malicious and benign origins. Despite these legitimate-seeming technical attributes, the domain has been flagged by one security blocklist for crypto drainer activity, though it remains undetected by antivirus engines as of this report. The subdomain 'ethdrainer' explicitly signals malicious intent, targeting cryptocurrency users through deceptive means. While the domain's current HTTP 500 error may temporarily hinder its operational status, defenders should treat it as active and high-risk. The lack of detections in some security tools does not confirm safety; rather, it highlights the need for proactive monitoring of Cloudflare Pages domains exhibiting similar naming patterns or error states. Network defenders are advised to block resolution to 172.66.44.252 and monitor for related subdomains or IP shifts, as threat actors frequently rotate infrastructure to maintain persistence.