connect-robenhood-get[.]pages[.]dev

This domain, connect-robenhood-get.pages.dev, operates as a crypto drainer phishing site designed to impersonate legitimate financial services, specifically targeting users of cryptocurrency platforms. The site employs social engineering tactics to deceive visitors into connecting their digital wallets, subsequently draining funds through malicious smart contract interactions. Analysis of the domain's infrastructure and content confirms it mimics trusted interfaces, exploiting brand recognition to facilitate unauthorized transactions and asset theft. Infrastructure analysis reveals the domain was registered on September 02, 2020, through Cloudflare, Inc., a registrar commonly utilized for both legitimate and malicious purposes. The domain resolves to the IP address 172.66.44.169, located within the United States under AS13335, Cloudflare’s autonomous system. Security vendor detections on VirusTotal indicate 12 out of 95 engines flag the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate, issued by Google Trust Services, further corroborates the domain's association with Cloudflare’s content delivery network, though this does not mitigate the inherent risk posed by the site’s phishing activity. Users who have visited connect-robenhood-get.pages.dev or interacted with its content are advised to take immediate remedial actions. Disconnect any linked wallets from the site and revoke permissions for suspicious smart contracts using a blockchain explorer. Conduct a thorough audit of wallet transactions for unauthorized activity and transfer remaining assets to a new, secure wallet. Monitor accounts for signs of compromise and report the domain to relevant security platforms to contribute to broader threat intelligence efforts. Given the high-risk classification, affected users should assume potential exposure of sensitive credentials or wallet access.