sponge--claim[.]pages[.]dev

This domain, sponge--claim.pages.dev, operates as a crypto drainer phishing site designed to steal cryptocurrency wallet credentials and drain funds from connected accounts. Crypto drainers are malicious scripts that execute unauthorized transactions once a victim connects their wallet, often through deceptive prompts or fake token claims. The threat is immediate and irreversible, as stolen assets are typically transferred to attacker-controlled wallets within seconds of interaction. Analysis indicates the domain was registered on March 06, 2024, through Cloudflare, Inc., and is hosted on Cloudflare’s infrastructure at the IPv6 address 2606:4700:310c::ac42:2d1d. Security vendors have flagged the domain as malicious, with 10 out of 95 engines on VirusTotal detecting it as a phishing or crypto-related threat. Additionally, the domain appears on three security blocklists and is explicitly blocked by multiple wallet protection tools. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing sites commonly use valid certificates to appear legitimate. If a user visited sponge--claim.pages.dev and connected a cryptocurrency wallet, they should immediately disconnect the wallet from any suspicious sites via their wallet settings. Next, transfer remaining funds to a new, secure wallet address not previously exposed to the phishing domain. Monitor all connected accounts for unauthorized transactions and revoke any suspicious token approvals or smart contract interactions. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. Report the incident to relevant blockchain security platforms to assist in tracking the attacker’s wallet addresses.