home-mtamsk-eng-wallet[.]pages[.]dev

On July 23, 2026, the domain home-mtamsk-eng-wallet.pages.dev was identified as a high‑risk crypto‑drainer infrastructure. The domain was created on February 21, 2026 and is registered through Cloudflare, Inc., using the authoritative nameservers graham.ns.cloudflare.com and nora.ns.cloudflare.com. DNS resolution points to the IP address 172.66.46.243, which belongs to ASN 13335 operated by Cloudflare, Inc., and is geographically located in the United States. The web service presented a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint, and the server advertised HTTP/3 along with enforced HSTS, consistent with Cloudflare’s edge platform. The only visible page title returned by the server was "Suspected phishing site | Cloudflare," and the HTTP response code was 403, suggesting the site was deliberately taken offline or blocked at the application layer.

Reputation services flagged the domain across multiple vectors. Google Safe Browsing labeled it as a social‑engineering threat, and VirusTotal recorded 14 positive detections out of 95 scanned security vendors, confirming malicious behavior. The Gridinsoft trust score was recorded as 0 / 100, and the domain appears on a single security blocklist, with PhishDestroy explicitly listing it as blocked. These indicators collectively corroborate the classification of the site as a crypto‑drain scam, consistent with the supplied scam type.

While the offline status (HTTP 403) limits immediate interaction, the retained infrastructure details remain actionable. Defenders should continue to block the IP 172.66.46.243 at network perimeters, enforce DNS sink‑holing for the domain, and share the indicator set with threat‑intel platforms. Ongoing monitoring of Cloudflare‑hosted assets is advised, as the provider’s shared infrastructure may host additional malicious actors.