passkeys-wallet-standalone[.]pages[.]dev

PhishDestroy’s automated systems flagged passkeys-wallet-standalone.pages.dev as an active crypto-draining endpoint. The domain masquerades as a standalone wallet service, leveraging the “passkeys” branding to lure cryptocurrency holders into authorizing malicious transactions via a recognized drainer kit. The page impersonates legitimate wallet interfaces and prompts users to connect their wallets, silently approving token transfers to attacker-controlled addresses once credentials are entered or wallet signatures are granted. Historical intelligence links this infrastructure to coordinated campaigns targeting MetaMask, Trust Wallet, and Phantom users across multiple regions. This domain was registered through Cloudflare, Inc. and currently resolves to IP 172.66.47.138. It holds a Google Trust Services SSL certificate and was flagged by 1 out of 95 VirusTotal security vendors. The page remains active at the time of analysis, with no evidence of takedown. The low detection rate suggests evasion tactics, possibly including fast flux or rapidly rotating subdomains under the same infrastructure. These attributes align with modern crypto-drainer toolkits designed for high anonymity and short operational lifespan. As of this report, passkeys-wallet-standalone.pages.dev is classified as an elevated-risk crypto drainer. PhishDestroy recommends immediate network-level and endpoint blocking of the domain and its resolving IP address. Users should refrain from visiting or interacting with any page hosted on *.pages.dev associated with wallet or key management claims. While the current Google Safe Browsing (GSB) status appears neutral, the low VT score and Cloudflare registration indicate potential for rapid abuse escalation. Remaining risk is assessed as elevated due to active hosting, SSL legitimacy, and lack of broad detection, emphasizing the need for proactive threat intelligence integration and user education on wallet connection hygiene.