aitrader-repo[.]pages[.]dev

This domain is assessed as high risk under a generic_phishing classification, with indicators consistent with a crypto drainer delivery environment. The page titled "CODE COMPILER" is likely used as a decoy interface to mask malicious asset interaction or wallet-triggering scripts.

Technical evidence shows VirusTotal detection ratio of 0/95, indicating no antivirus engine detections at time of analysis, while operational blocklisting is active across 3 security blocklists, including MetaMask and SEAL. The domain is registered through Cloudflare, Inc., hosted under IP 188.114.97.3 within AS13335 (Cloudflare, Inc.), secured via Google Trust Services / WE1 certificate. The domain was created on June 20, 2026 and remains currently active. These infrastructure details indicate a newly deployed yet already partially flagged phishing infrastructure.

If a user has interacted with this domain, immediate actions should include revoking any connected wallet permissions, rotating credentials if any login data was entered, and scanning the system for injected scripts or browser extensions. Network defenders should block IP 188.114.97.3 and enforce domain-level filtering for Cloudflare-hosted newly registered domains exhibiting crypto-related UI patterns. Continuous monitoring is recommended due to low VT visibility (0/95) combined with multiple independent blocklist detections.