demo-connect-wallet[.]pages[.]dev

Analysis of demo-connect-wallet.pages.dev indicates an active crypto‑drainer campaign. The domain was registered on April 22 2026 through Cloudflare, Inc., and resolves to the Cloudflare‑owned address 172.66.46.221 located in Canada. DNS resolution uses the Cloudflare nameservers alec.ns.cloudflare.com and melinda.ns.cloudflare.com, and the site presents a valid SSL certificate issued by Google Trust Services / WE1. The page title returned by the server is "Neologism Connect Wallet Demo," and the HTTP response code is 200. Detected infrastructure includes HSTS, Cloudflare services, and HTTP/3, confirming the use of modern web delivery mechanisms. The domain has been flagged by the PhishDestroy blocklist and appears on a single security blocklist; Gridinsoft assigns a trust score of 0 / 100. VirusTotal reports that 94 scanners have examined the site, with no current vendor flags, but the absence of detections does not constitute assurance of safety. The campaign’s risk level is under investigation, and its operational status remains active. Defenders should consider adding the domain to outbound filtering rules, monitoring DNS queries for the associated IP range, and employing URL‑reputation services that incorporate the blocklist indicator. Continuous observation is advised to detect any escalation or additional malicious payloads that may be delivered from this infrastructure.