switchnodedesk[.]pages[.]dev

This domain, switchnodedesk.pages.dev, is flagged as a high-risk crypto wallet drainer phishing site targeting users of Web3 and multichain self-custodial services. The page title, 'We are unifying Web3 by providing best-in-class, self-custodial, and multichain support,' mimics legitimate decentralized finance (DeFi) platforms to deceive victims into connecting their wallets, likely triggering unauthorized transactions or credential harvesting. No specific drainer kit signature has been confirmed, but the domain exhibits behavioral indicators consistent with wallet-draining campaigns, including Cloudflare-hosted infrastructure and a recent creation date. Analysis indicates the domain resolves to the IP address 172.66.45.26, registered through Cloudflare, Inc. on March 24, 2026. VirusTotal reports 8 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing (GSB) status is not explicitly provided, but the domain remains active and unblocked by major browsers at the time of analysis. The IP geolocation is associated with Cloudflare’s infrastructure in Canada. The domain remains active, posing an ongoing risk to users engaging with Web3 and cryptocurrency services. Response actions include monitoring for additional blocklist inclusions and analyzing connected wallet addresses for transaction anomalies. Organizations should update web filtering rules to block this domain and its associated IP. Users are advised to verify domain authenticity before interacting with any Web3 service, particularly those soliciting wallet connections. Given the domain’s recent registration and Cloudflare hosting, further infrastructure pivots may occur, necessitating continuous threat intelligence updates.