web3walletautofix[.]pages[.]dev

Analysis indicates that the domain web3walletautofix.pages.dev was created on March 10 2026 and currently resolves to the IP address 172.66.47.11, which belongs to Cloudflare’s AS13335 network located in the United States. The domain is registered through Cloudflare, Inc., and uses Cloudflare name servers iris.ns.cloudflare.com and john.ns.cloudflare.com. The site presents the page title “DebbugDappNode” and is classified in the supplied intelligence as a “Crypto Scam” with a specific focus on draining cryptocurrency assets. Security telemetry shows that eleven of ninety‑four VirusTotal scanners flagged the domain as malicious, and it appears on a single external blocklist. The domain has been blocked by the PhishDestroy service.

Technical headers observed include HTTP/3 and the presence of HTTP Strict Transport Security (HSTS), which are typical of Cloudflare‑served sites. The SSL certificate associated with the domain is identified as “E8”, indicating that a Cloudflare‑issued certificate is in use. Current operational status is listed as offline, suggesting that the site is no longer actively serving content. However, the combination of recent creation, Cloudflare infrastructure, malicious detection by multiple AV engines, and explicit classification as a crypto drainer warrants continued monitoring. Defenders should ensure that any inbound traffic to 172.66.47.11 is logged and, where possible, blocked at the network perimeter until the domain is definitively retired.

Incident response teams should also correlate any recent cryptocurrency transaction anomalies with this domain, particularly if victims reported compromised wallet credentials. Because the domain leverages a reputable CDN, it may evade simple domain‑based allowlists; therefore, threat‑intel feeds that include the specific indicator "web3walletautofix.pages.dev" and the associated IP should be incorporated into detection rules.