wallet-watcher[.]pages[.]dev

This domain, wallet-watcher.pages.dev, is actively flagged as a crypto drainer, a threat type designed to siphon cryptocurrency assets from connected digital wallets. The site impersonates the VeChain Blockchain Intelligence Platform, using the page title 'WalletWatcher - VeChain Blockchain Intelligence Platform' to lend credibility to its malicious operations. As of the latest analysis, the domain remains operational and continues to pose a high risk to users interacting with blockchain-related services. Infrastructure analysis reveals that wallet-watcher.pages.dev resolves to the IP address 188.114.96.3, hosted under Cloudflare, Inc. in Canada. The domain was registered through Cloudflare Pages on March 28, 2026, though this date may reflect automated provisioning rather than traditional domain registration. Detection metrics indicate limited but targeted flagging, with 3 of 95 security vendors on VirusTotal identifying the domain as malicious. Additionally, the domain appears on a single security blocklist, specifically PhishDestroy. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains, which does not mitigate the threat posed by this infrastructure. Current status confirms that wallet-watcher.pages.dev remains active and unmitigated. Users and organizations are advised to block the domain at the network level, including the resolving IP 188.114.96.3, to prevent accidental exposure. Cryptocurrency wallet providers should integrate detection for this domain into their transaction validation systems to halt asset transfers to associated addresses. End users are strongly cautioned against connecting wallets or entering seed phrases on this platform, as interaction may result in immediate and irreversible asset loss. Continuous monitoring of related infrastructure is recommended, as crypto drainers frequently rotate domains and IPs to evade detection.