welcome-upholdwallet[.]pages[.]dev

This domain, welcome-upholdwallet.pages.dev, operates as a crypto drainer designed to siphon digital assets from connected cryptocurrency wallets. Crypto drainers function by injecting malicious JavaScript into seemingly legitimate interfaces, tricking users into authorizing transactions that transfer funds to attacker-controlled addresses. The site specifically targets wallet credentials and session tokens, enabling unauthorized access to victims' holdings without immediate detection. Given the irreversible nature of blockchain transactions, financial losses from such attacks are typically permanent and may escalate rapidly once access is granted. Analysis indicates this domain was registered on November 03, 2025, through Cloudflare, Inc., a provider frequently leveraged by threat actors to obscure infrastructure and evade detection. The domain resolves to IP address 172.66.44.105, hosted on AS13335, a network commonly associated with proxy services that mask true origin points. Security validation reveals 14 out of 95 vendors on VirusTotal flagged the domain as malicious, with additional detections from Google Safe Browsing and a specialized blocklist. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust signal, as certificates are routinely issued to malicious domains during automated provisioning processes. Individuals who visited welcome-upholdwallet.pages.dev or interacted with its content should immediately revoke any wallet authorizations granted during the session. This includes disconnecting the site from wallet extensions and reviewing all recent transactions for unauthorized activity. If credentials or seed phrases were entered, the compromised wallet should be considered fully exposed, and funds should be transferred to a new, secure wallet with a fresh seed phrase. Monitor connected accounts for suspicious login attempts or transaction requests, and enable multi-factor authentication where available. Given the high-risk classification and offline status, users should remain vigilant for follow-up attacks, such as phishing emails or social engineering attempts referencing this incident.