qwallet[.]pages[.]dev

PhishDestroy identifies qwallet.pages.dev as an active cryptocurrency drainer site under ongoing investigation. The domain employs deceptive tactics to trick users into connecting their wallets and transferring crypto assets directly to attacker-controlled addresses. qwallet.pages.dev resolves to IP 188.114.96.3 and is registered through Cloudflare, Inc. The site holds a Google Trust Services SSL certificate, which does not indicate legitimacy. VirusTotal currently reports 0/95 detections, suggesting it has evaded detection by most antivirus engines. Hosted on Cloudflare Pages, the domain leverages the platform’s infrastructure to obscure its origins while maintaining operational availability. Despite its use of a reputable CDN and certificate authority, the site’s intent remains malicious, focusing on the unauthorized extraction of cryptocurrency through wallet connection scams. This domain was flagged under seed 98f19c after behavioral analysis revealed red flags consistent with crypto drainer operations, including prompts to connect wallets, approve malicious transactions, and transfer tokens to external addresses. Users and organizations are advised to block access to qwallet.pages.dev immediately. If exposure has occurred, disconnect wallets, revoke any suspicious approvals via blockchain explorers, and report the incident to relevant crypto security platforms such as MetaMask or WalletConnect. Always verify URLs and use hardware wallets for high-value transactions to minimize exposure to such attacks.