webswitchdapp[.]pages[.]dev

The domain webswitchdapp.pages.dev is actively operating as a crypto drainer phishing site, designed to deceive users into connecting wallets and authorizing malicious transactions. Analysis indicates this infrastructure targets cryptocurrency holders by impersonating legitimate decentralized application interfaces, specifically exploiting trust in wallet-switching functionalities. The page title 'APP TRUST FIXED' suggests an attempt to manipulate users into believing the platform resolves security issues, a common social engineering tactic in crypto-related fraud. Infrastructure analysis reveals multiple high-confidence threat indicators. The domain was registered on September 17, 2024, through Cloudflare, Inc., and currently resolves to the IP address 188.114.97.3, geolocated in Canada under Cloudflare’s network. Security vendors have flagged this domain as malicious, with 11 of 95 VirusTotal engines detecting it as phishing. It appears on three security blocklists and is actively blocked by multiple wallet protection systems. Google Safe Browsing has also classified this domain as phishing, reinforcing its fraudulent nature. The domain remains active as of the latest verification, posing an ongoing threat to unsuspecting users. Security teams recommend immediate blocking of this domain at the network level and inclusion in endpoint protection rules. Users who may have interacted with this site should revoke any connected wallet authorizations, transfer assets to a new wallet, and monitor accounts for unauthorized transactions. Organizations should treat this domain as a confirmed crypto drainer and prioritize its addition to threat intelligence feeds.