recover-cosmos-wallet[.]pages[.]dev

The domain recover-cosmos-wallet.pages.dev is identified as a crypto drainer site, specifically targeting users of the Cosmos blockchain. The threat involves a wallet recovery scam designed to trick users into revealing their private keys or other sensitive information, which can then be used to drain their cryptocurrency assets. No specific drainer kit has been identified, but the domain’s infrastructure and behavior suggest it is part of a targeted campaign.

Technical analysis reveals that the domain has a VirusTotal score of 0/95, indicating that it has not been flagged by most security engines. The domain is registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.181, which is located in the United States under the AS13335 Cloudflare, Inc. network. The SSL certificate is issued by Google Trust Services / WE1, which may lend a false sense of security to unsuspecting users. The domain appears on 1 security blocklist, specifically PhishDestroy, and its presence on this list suggests that it has been involved in malicious activities. The creation date of the domain is not provided, but it is currently active.

The current status of the domain is active, and while it has not been widely detected, the presence on a known security blocklist and the nature of the threat indicate a significant risk. Organizations and individuals are advised to block this domain to prevent potential data breaches and financial losses. Further investigation is recommended to identify the full scope of the campaign and any additional infrastructure used. Users should avoid interacting with the site and report any suspicious activity to their security teams.