abra-xas-wallet-access[.]pages[.]dev

PhishDestroy identifies abra-xas-wallet-access.pages.dev as an active crypto drainer campaign leveraging a spoofed wallet access interface. The domain is designed to trick victims into connecting cryptocurrency wallets, enabling unauthorized asset transfers via a malicious drainer kit. The threat actor impersonates legitimate wallet services to deceive users into granting permissions, with observed payloads targeting Ethereum and Solana ecosystems. Seed hash 6e221d correlates this domain with prior drainer infrastructure.

Technical indicators confirm this domain is weaponized: VirusTotal shows 1/95 detections despite active abuse, the domain resolves to Cloudflare-hosted IP 188.114.96.3 under Cloudflare, Inc. registrar, and utilizes a Google Trust Services SSL certificate for added credibility. While Google Safe Browsing (GSB) status remains unflagged, the absence of detections highlights evasion tactics. The domain’s recent activation and low VT score suggest it is part of a rapidly evolving campaign.

Current status is active with ongoing redirection attempts observed. Immediate containment requires blocking the domain at DNS/network level and flagging the IP 188.114.96.3 in perimeter defenses. Users should avoid interacting with this domain entirely and report any suspicious wallet connection prompts. Remaining risk is high due to the drainer’s ability to bypass initial detection layers, emphasizing the need for real-time threat intelligence updates and wallet-level safeguards.