soldrainerupdate[.]pages[.]dev

Analysis of soldrainerupdate.pages.dev indicates an active credential-phishing domain targeting cryptocurrency wallet users. The domain, registered through Cloudflare, Inc., resolves to IP address 188.114.96.3 and uses Cloudflare nameservers (delilah.ns.cloudflare.com, joaquin.ns.cloudflare.com). As of July 29, 2026, the domain appears on three security blocklists and is flagged by detection vendors including PhishDestroy, MetaMask, and SEAL. VirusTotal reports three out of ninety-one security vendors identifying the domain as malicious, reinforcing its elevated risk classification.

Infrastructure analysis reveals the domain is hosted on Cloudflare's network, a common tactic to obscure origin servers and leverage SSL encryption. No specific brand impersonation details are confirmed beyond the implied targeting of wallet credentials, as suggested by the domain name and detection context. The exact content of the phishing page remains unanalyzed, though the domain name aligns with known wallet-draining schemes. Defenders should prioritize blocking this domain at DNS and network levels, particularly in environments handling cryptocurrency transactions.

Monitoring for connections to 188.114.96.3 or related Cloudflare-hosted domains may help identify compromised systems. Given the domain's presence on multiple blocklists and detection by specialized crypto-phishing tools, organizations should treat it as a confirmed threat until further evidence suggests otherwise. No additional registration or HTTP response details are available to refine the assessment.