walletv-web[.]pages[.]dev

PhishDestroy has identified walletv-web.pages.dev as an active crypto drainer threat. The domain impersonates the 'Wallet Verification Union' brand, a fraudulent entity designed to trick users into connecting their cryptocurrency wallets. This drainer kit is hosted on Cloudflare Pages, leveraging the pages.dev subdomain to appear legitimate. The site's Chinese-language title, '钱包验证联盟 - Wallet Verification Union', targets non-English speakers and exploits trust in wallet verification services.

Technical indicators reveal that walletv-web.pages.dev resolves to IP address 172.66.44.158 and was registered through Cloudflare, Inc. with a creation date of April 5, 2026. The domain holds an SSL certificate issued by Google Trust Services / WE1, and VirusTotal reports 0 detections out of 95 scanners, meaning it has not yet been flagged by antivirus engines. However, it does appear on 1 security blocklist, indicating early-stage recognition. Google Safe Browsing status is not explicitly listed, but given the lack of VT detections, it is likely not yet blocked by GSB.

Currently, the domain remains active and accessible, posing a continuing risk to cryptocurrency users. PhishDestroy recommends that organizations block access to walletv-web.pages.dev at the DNS and proxy level, and users should avoid connecting any wallets or entering credentials on the site. Security teams should monitor for similar domains using the Wallet Verification Union branding and report the domain to threat intelligence feeds. While the drainer has not yet achieved widespread detection, its active status and low blocklist coverage make it a significant threat that requires immediate action.