phomts-wallet[.]pages[.]dev

Analysis of phomts-wallet.pages.dev indicates a high‑risk crypto‑drainer operation that has been taken offline as of the report date. The domain was registered on February 21, 2026 through Cloudflare, Inc., and it resolves to the Cloudflare‑owned address 188.114.97.3, which belongs to AS13335 in the United States. DNS resolution uses the Cloudflare nameservers dion.ns.cloudflare.com and audrey.ns.cloudflare.com. The site presented a TLS certificate issued by Google Trust Services under the WE1 identifier, and the HTTP response returned a 403 status code with HSTS and HTTP/3 enabled, reflecting typical Cloudflare security settings.

The page title recorded by scanners reads "Suspected phishing site | Cloudflare," and Google Safe Browsing classified the URL as social engineering. VirusTotal recorded 12 detections out of 93 scanning engines, reinforcing the malicious assessment. Additional security products have contributed to its reputation: Gridinsoft assigned a trust score of 0 out of 100, PhishDestroy listed the domain as blocked, and it appears on one external security blocklist. The primary threat vector is identified as a crypto scam, consistent with the "Crypto Scam" classification in the intelligence feed.

No further details about the payload, targeted wallets, or victim interaction have been captured, leaving the exact phishing mechanics uncertain. Defenders should immediately block the domain at DNS and network layers, monitor for any residual traffic to the IP address, and update detection signatures to include the observed TLS fingerprint and HTTP status pattern. Continuous observation of Cloudflare‑hosted infrastructure for similar domains is advised, as the provider’s shared IP space can host multiple abusive actors.