migrate-covalent[.]pages[.]dev

This domain, migrate-covalent.pages.dev, is flagged as a high-risk crypto wallet drainer phishing site designed to mimic the legitimate Covalent platform. Analysis indicates the site employs social engineering tactics, specifically fraudulent migration prompts, to trick users into connecting their wallets, enabling unauthorized fund transfers. The infrastructure is optimized for deception, leveraging JavaScript libraries such as crypto-js to facilitate malicious transactions while evading basic detection mechanisms. Infrastructure analysis reveals multiple technical indicators of compromise. The domain resolves to IP address 188.114.97.3, registered through Cloudflare on April 22, 2026, with an SSL certificate issued by Google Trust Services. It is detected by 13 out of 95 security vendors on VirusTotal and appears on four independent security blocklists, including MetaMask and ScamSniffer. The domain employs HSTS, HTTP/3, and content delivery networks such as jsDelivr and cdnjs to enhance performance and legitimacy perception, despite its fraudulent intent. As of the latest assessment, migrate-covalent.pages.dev has been taken offline, likely in response to widespread detection and blocklisting. However, residual risk remains due to potential rehosting under similar domains or altered infrastructure. Users who interacted with the site are advised to revoke wallet permissions, transfer assets to new wallets, and monitor transaction histories for unauthorized activity. Continuous vigilance is recommended, as threat actors frequently rotate domains and IPs to evade detection.