elements-6tg[.]pages[.]dev

This domain, elements-6tg.pages.dev, is flagged as a high-risk crypto wallet drainer phishing site targeting users of the Element NFT marketplace. The page mimics the legitimate platform's branding, presenting itself as 'Element: Buy NFTs, Crypto Collectibles, GameFi Asset' to deceive victims into connecting wallets, likely leading to unauthorized token transfers. No specific drainer kit signature has been confirmed, but the domain exhibits characteristics consistent with wallet-draining phishing infrastructure. Analysis indicates the domain was registered through Cloudflare, Inc. and resolves to IP address 172.66.44.229, geolocated to California. The domain was created on March 28, 2026, though this date may reflect Cloudflare Pages' default registration behavior rather than actual malicious intent timing. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and phishing sites. The domain appears on one security blocklist and is currently blocked by at least one threat intelligence feed. As of the latest verification, elements-6tg.pages.dev remains active and continues to host the phishing content. The infrastructure analysis reveals Cloudflare's hosting environment, which provides anonymity and resilience against takedowns. Users are advised to treat any interaction with this domain as malicious, particularly wallet connection prompts. Network-level blocking of the IP 172.66.44.229 and monitoring for related subdomains under pages.dev is recommended. The remaining risk is classified as high due to the active status and direct targeting of cryptocurrency assets.