frogg[.]pages[.]dev

This domain, frogg.pages.dev, is actively distributing a crypto drainer scheme targeting users of the Coin Node platform. Analysis indicates the site mimics legitimate cryptocurrency node services, likely to trick victims into connecting wallets or entering private keys. The page title, COIN NODE, directly references the targeted brand, suggesting an intent to deceive users familiar with cryptocurrency infrastructure. No specific drainer kit signatures have been confirmed, but the domain’s behavior aligns with known wallet-draining campaigns observed in recent months. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on April 30, 2026, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, which is associated with a content delivery network. Security vendors on VirusTotal have flagged the domain as malicious, with 13 out of 95 engines detecting it. The domain appears on two security blocklists, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing currently lists the domain as unsafe, further corroborating its fraudulent nature. As of the latest assessment, frogg.pages.dev remains active and continues to pose a high risk to users. Response actions include blocking by multiple security providers, but the domain persists due to its hosting on a widely used content delivery network. Users are advised to avoid interacting with the site, verify wallet connections, and monitor for unauthorized transactions. Organizations should update blocklists and educate users about crypto drainer threats, particularly those impersonating node services or wallet providers. The remaining risk is elevated due to the domain’s active status and the irreversible nature of cryptocurrency theft.