test-wallet[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation threat targeting WalletConnect, a widely used cryptocurrency wallet connection protocol. The site mimics legitimate WalletConnect services, likely to facilitate crypto drainer attacks or credential harvesting under the guise of a "test wallet." The specific threat type involves social engineering tactics to deceive users into connecting wallets or entering sensitive information, enabling unauthorized access to digital assets. Analysis indicates the domain test-wallet.pages.dev was registered on February 17, 2022, through Cloudflare Pages, a platform often exploited for rapid deployment of phishing infrastructure. The domain resolves to IP address 172.66.44.206 and is currently active despite being blocked by at least one security blocklist. VirusTotal reports 2 out of 95 security vendors flagging the domain as malicious, a low detection rate that may reflect evasion techniques or recent activation. The SSL certificate is issued by Google Trust Services (WE1), a legitimate provider, which can lend false credibility to the site. The page title, "WalletConnect Test Wallet," explicitly references the targeted brand, reinforcing the impersonation attempt. Mitigation requires immediate action from security teams and end users. Network-level blocking of the domain and its resolving IP (172.66.44.206) should be implemented to prevent access. WalletConnect users should verify domain authenticity before interacting with any wallet connection prompts, particularly those labeled as "test" or "demo" environments. Organizations should monitor for connections to test-wallet.pages.dev in web logs and endpoint telemetry, as such activity may indicate compromised credentials or attempted fraud. Security awareness training should emphasize the risks of impersonation attacks targeting cryptocurrency services, including the use of legitimate-looking but unauthorized test environments.