data-center-claim-reporting[.]pages[.]dev

This domain, data-center-claim-reporting.pages.dev, is identified as a crypto drainer, a type of malicious infrastructure designed to automatically siphon cryptocurrency from connected wallets without user consent. Victims are typically lured through deceptive prompts, such as fake airdrops, reward claims, or security alerts, which trigger unauthorized transactions when interacted with. The threat is particularly insidious because it operates silently, often draining funds before the user realizes the compromise. Crypto drainers are commonly deployed in campaigns targeting decentralized finance (DeFi) users, non-fungible token (NFT) communities, and cryptocurrency holders seeking to claim rewards or verify transactions. Analysis indicates this domain was flagged by 12 out of 95 security vendors on VirusTotal, a clear indicator of its malicious intent. The domain was registered through Cloudflare, Inc. on February 21, 2026, and resolves to the IP address 172.66.47.36, which is part of Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to lend legitimacy to their infrastructure. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The creation date suggests it may have been part of a short-lived campaign, as domains of this nature are often taken down or abandoned quickly to evade detection. The page title, 'Suspected phishing site | Cloudflare,' further confirms its deceptive nature, as legitimate services do not use such generic or self-incriminating labels. If a user has visited this domain or interacted with its content, immediate action is required to mitigate potential damage. First, disconnect any cryptocurrency wallets from the site and revoke all connected dApp permissions using a blockchain explorer or wallet management tool. Next, transfer remaining funds to a new, secure wallet to prevent further unauthorized access. Monitor transaction histories for any suspicious activity and report the incident to relevant platforms, such as cryptocurrency exchanges or wallet providers, to flag the address for potential fraud. Additionally, scan the device used to access the site for malware, as crypto drainers are often distributed alongside other malicious payloads. Users should also enable transaction simulation tools or browser extensions that warn against interacting with known malicious domains. Finally, report the domain to security databases and blocklist providers to aid in broader threat mitigation efforts.