usdcdrainer[.]pages[.]dev

This domain, usdcdrainer.pages.dev, operates as an active crypto drainer infrastructure designed to siphon cryptocurrency assets from victims by impersonating legitimate wallet or exchange services. The page title, 'Crypto Drainer Agency,' explicitly indicates its malicious intent to deploy wallet-draining scripts upon user interaction. Such threats typically employ social engineering tactics, including fake airdrop promotions or fraudulent transaction prompts, to deceive users into connecting their wallets to the malicious interface, enabling unauthorized fund transfers. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on May 12, 2025, and currently resolves to the IP address 188.114.96.3, hosted under Cloudflare’s network in Canada. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of attacker-controlled domains leveraging legitimate CDN providers to obfuscate their origin. Detection metrics indicate limited but targeted visibility, with only 1 of 95 security vendors flagging the domain on VirusTotal. Additionally, the domain appears on a single security blocklist, suggesting early-stage deployment or evasion techniques to avoid broader detection. Users who have interacted with usdcdrainer.pages.dev or connected a cryptocurrency wallet to the site should immediately revoke any active wallet permissions associated with the domain. Affected individuals should transfer remaining assets to a new, secure wallet and monitor transaction histories for unauthorized activity. Given the domain’s active status and minimal detection footprint, heightened vigilance is advised when encountering unsolicited cryptocurrency-related links or prompts. Organizations should update blocklists to include this domain and its associated IP address to mitigate further exposure.