embed-core-site[.]pages[.]dev

PhishDestroy has classified embed-core-site.pages.dev as a high-risk crypto drainer phishing site under active investigation. This domain is designed to trick users into connecting their cryptocurrency wallets, ultimately draining funds through malicious smart contracts. The site poses as a legitimate tool called 'EmbedCore — Local Intelligence for Your Files,' but its true purpose is credential theft and asset theft.

The domain was created on June 15, 2026, and registered through Cloudflare, Inc., which often provides anonymity for threat actors. It resolves to IP address 172.66.46.230 and currently holds an SSL certificate from Let's Encrypt (E8), lending a false sense of security. VirusTotal analysis shows 0 out of 95 security vendors have flagged it, indicating it evades detection, yet it appears on one security blocklist. This low detection rate underscores the need for heightened awareness.

Users should never connect their wallets or enter sensitive information on this site. To stay safe, always verify URLs before interacting, use browser extensions that block known phishing domains, and enable two-factor authentication on all crypto accounts. If you have already interacted with the site, immediately revoke any smart contract approvals and transfer funds to a new wallet. Report the domain to your security team and consider using a hardware wallet for future transactions.