jesus-91j[.]pages[.]dev

Domain jesus-91j.pages.dev has been flagged for potential crypto drainer activity, a form of credential theft targeting cryptocurrency wallets. This malicious infrastructure impersonates a religious-themed page but is likely designed to deceive users into connecting their wallets to drain funds. No specific drainer kit or brand impersonation was identified in the current analysis, though the generic nature of the domain suggests opportunistic theft rather than targeted impersonation.

Technical indicators reveal a newly registered domain resolving to IP 188.114.97.3 via Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. VirusTotal currently reports 0/95 detections, indicating low signature-based detection but not ruling out behavioral anomalies. The domain’s age and lack of historical reputation suggest it may be part of a fast-flux or bulletproof hosting pattern, designed to evade immediate takedown. As of this analysis, the domain remains unlisted on major blocklists, heightening the risk of successful engagement by unsuspecting users.

This domain is currently active and under investigation with a risk level marked as 'under_investigation'. Immediate defensive actions should include blocking jesus-91j.pages.dev and 188.114.97.3 at the network perimeter, alongside inspecting outbound DNS queries for related domains. While the threat is not yet confirmed, the combination of low VT coverage, fresh registration, and crypto-drainer potential warrants proactive blocking. Users are advised to verify any unsolicited .pages.dev domains before interaction and report findings to threat intelligence teams to improve detection coverage and reduce risk exposure.