walrus[.]pages[.]dev

This domain is flagged as a high-risk crypto wallet drainer, a specialized form of phishing designed to siphon cryptocurrency assets by tricking users into connecting compromised wallets. The threat type is narrowly targeted, focusing on credential theft and unauthorized transaction execution through deceptive wallet interfaces, often mimicking legitimate decentralized applications or exchange platforms. Infrastructure analysis reveals the domain walrus.pages.dev was registered on February 28, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.46.228. Despite its recent creation date, the domain has already been blocked by multiple security entities, including MetaMask and PhishDestroy, and appears on three security blocklists. The SSL certificate is issued by Google Trust Services, and technologies such as HSTS, Cloudflare, and HTTP/3 are detected. Notably, VirusTotal reports 0 out of 95 detections, indicating the domain has not yet been widely flagged by antivirus engines. The Gridinsoft trust score of 0/100 further corroborates its malicious classification. Mitigation steps for this specific threat type include immediately revoking any wallet connections to the domain and auditing recent transactions for unauthorized activity. Users should verify wallet addresses using trusted sources and enable hardware wallet protections where available. Organizations should update firewall rules to block the domain and its resolving IP (172.66.46.228) at the network level. Given the domain's reliance on Cloudflare infrastructure, monitoring for similar patterns—such as newly registered pages.dev subdomains—can help preemptively identify related threats. Security teams are advised to conduct retroactive log analysis to detect any prior interactions with this domain or its associated IP address.