kitacoba[.]pages[.]dev

Analysis of the domain kitacoba.pages.dev indicates it is actively associated with crypto drainer fraud. The domain is hosted on Cloudflare Pages infrastructure, resolving to IP 188.114.97.3 (Cloudflare, Inc., CA). Its SSL certificate is issued by Google Trust Services (WE1), a common configuration for legitimate and malicious sites alike. The domain was registered on March 25, 2026, and currently returns an HTTP 200 status, suggesting the page is operational. The page title, 'THE NFT WORLD,' aligns with known patterns of crypto-related scams, particularly those targeting digital asset theft. The domain appears on two security blocklists (PhishDestroy and ScamSniffer) and is classified as a crypto drainer, a type of scam designed to siphon cryptocurrency from victims' wallets. Gridinsoft assigns it a trust score of 0/100, reinforcing its high-risk classification. While no detections were reported by 94 vendors in a recent scan, the absence of detections does not confirm safety, as new or evasive threats may not be immediately flagged. Infrastructure analysis reveals no unusual hosting patterns, but the use of Cloudflare Pages is consistent with threat actors leveraging legitimate services to obscure malicious activity. Defenders should treat this domain as active and high-risk, particularly in environments where cryptocurrency transactions occur. Monitoring for connections to this domain, blocking it at the network level, and alerting users to its fraudulent nature are recommended mitigation steps. The exact content and functionality of the site remain unanalyzed, but its classification as a crypto drainer warrants immediate caution.