defianchor[.]pages[.]dev

PhishDestroy has identified defianchor.pages.dev as an active crypto drainer threat, masquerading under the fake brand 'CexRpc Decentralized DApp'. This domain is designed to trick users into connecting their cryptocurrency wallets, after which it executes malicious transactions to drain funds. The site is part of a known drainer kit operation, targeting unsuspecting DeFi users.

Technical analysis reveals that the domain resolves to IP address 172.66.47.87 and was registered through Cloudflare, Inc. on January 17, 2025. VirusTotal flags it with a score of 3 out of 95 security vendors, indicating significant malicious consensus. It appears on three security blocklists, and its SSL certificate is issued by Google Trust Services (WE1). Google Safe Browsing has not yet listed it, but given its active status, it remains a high risk.

Currently, defianchor.pages.dev is still active and accessible. Users are strongly advised to avoid visiting the site or connecting any wallets to it. If any credentials or wallet access have been compromised, immediate action should be taken to revoke permissions and transfer assets to a secure wallet. PhishDestroy continues to monitor this domain and updates will be provided as the situation evolves.