opp-sec[.]pages[.]dev

This domain, opp-sec.pages.dev, operates as an active crypto drainer phishing endpoint designed to deceive users into authorizing malicious smart contract interactions. Analysis indicates the site mimics legitimate wallet security verification prompts, tricking victims into signing transactions that directly transfer cryptocurrency assets to attacker-controlled addresses. The threat specifically targets users of decentralized finance platforms and wallet extensions, exploiting urgency and false security warnings to bypass user scrutiny. Infrastructure analysis reveals the domain was registered through Cloudflare Pages on May 27, 2026, with a creation date suggesting recent deployment for this campaign. Detection metrics show limited but targeted coverage, with 1 of 95 security vendors on VirusTotal flagging the domain at the time of analysis. The domain appears on four independent security blocklists, including entries from specialized blockchain security trackers, confirming its classification as a high-risk crypto drainer resource. Users who have interacted with opp-sec.pages.dev should immediately revoke any suspicious smart contract approvals through their wallet interface and transfer remaining assets to a new, secure wallet address. It is recommended to monitor transaction histories for unauthorized transfers and report the incident to relevant blockchain security platforms. No further interaction with the domain should occur, and all cached credentials or session data associated with the site should be cleared from affected devices.