layerxxyz[.]pages[.]dev

This domain, layerxxyz.pages.dev, is confirmed as an active crypto drainer phishing site targeting cryptocurrency wallet users. Analysis indicates the site employs malicious scripts designed to drain funds from connected wallets by tricking users into signing fraudulent transactions. The threat type is classified as a high-risk crypto drainer, a specialized form of phishing that directly targets digital asset holdings rather than credentials alone. The infrastructure and page title, Wallets | Linkup Affixs, suggest an attempt to mimic legitimate wallet service providers, increasing the likelihood of successful deception. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 12 out of 95 security vendors on VirusTotal, a significant detection rate that underscores its malicious nature. It resolves to the IP address 188.114.96.3, hosted under Cloudflare, Inc., with an SSL certificate issued by Let’s Encrypt (serial number E7). The domain was registered on April 13, 2026, through Cloudflare, Inc., and is currently active despite being listed on four security blocklists, including high-profile threat intelligence feeds. The use of Cloudflare hosting is a common tactic to obscure the true origin of the attack and leverage the provider’s CDN for rapid deployment. Mitigation against this threat requires immediate action from both end-users and network administrators. Users who may have interacted with the domain should revoke any wallet permissions granted to the site and transfer assets to a new, secure wallet address. Network-level protections should include blocking the domain and its resolving IP (188.114.96.3) at firewalls and DNS resolvers. Organizations are advised to monitor for connections to this IP or domain in logs, as it may indicate compromised endpoints. Given the high-risk nature of crypto drainers, proactive measures such as disabling JavaScript execution for untrusted domains or employing browser-based transaction simulation tools can further reduce exposure. Continuous threat intelligence monitoring is recommended to track the domain’s activity, as phishing infrastructure often evolves rapidly.