app-iron-wallet-eng-us[.]pages[.]dev

PhishDestroy identifies app-iron-wallet-eng-us.pages.dev as an active crypto drainer domain designed to siphon cryptocurrency from unsuspecting users. This site masquerades as a legitimate crypto wallet service but operates as a sophisticated phishing portal, intercepting private keys, seed phrases, or wallet connection requests to authorize unauthorized crypto transfers. The domain employs obfuscation techniques, including the use of Cloudflare’s infrastructure, to evade detection and prolong its operational window. Users who interact with this domain risk irreversible financial losses as funds are rapidly transferred to attacker-controlled wallets. This domain was flagged through PhishDestroy’s automated analysis pipeline, revealing critical threat indicators. Resolving to IP 188.114.97.3 via Cloudflare, Inc., the domain currently shows zero detections on VirusTotal out of 95 engines scanned—a red flag indicating minimal exposure despite active malicious activity. The SSL certificate issued by Google Trust Services complicates detection for users relying solely on HTTPS validation. With threat type classified as active crypto drainer and a unique seed identifier (5b0de3), this domain represents a high-risk vector in the current threat landscape. If you have visited app-iron-wallet-eng-us.pages.dev, immediately revoke all connected wallet permissions through your wallet’s security settings and transfer remaining funds to a newly generated, isolated wallet. Do not reuse seed phrases or private keys exposed to this domain. Report the domain to your wallet provider and relevant authorities such as the FBI IC3 or local cybercrime units. Monitor blockchain transactions and crypto balances for unauthorized activity. Share this advisory to help prevent others from falling victim to this drainer scam.