gamium-world[.]pages[.]dev

PhishDestroy identifies gamium-world.pages.dev as an active crypto drainer phishing domain under investigation for generic phishing behavior. This domain impersonates gaming-related services to trick users into connecting cryptocurrency wallets, whereupon malicious scripts drain assets via approved transaction signatures. No specific drainer kit hash or family has been extracted at this time, but the site’s behavior aligns with known crypto wallet drainer kits hosted on Pages.dev subdomains. The payload is delivered through deceptive landing pages that imitate legitimate gaming platforms, prompting victims to ‘connect wallet’ under false pretenses to steal tokens. This domain resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc. using Google Trust Services SSL certificates. VirusTotal currently flags the domain with 0 out of 95 detections, indicating it evades most antivirus and browser-based detection engines as of the latest scan. While the Google Safe Browsing (GSB) status remains unconfirmed in the provided data, historical trends suggest Pages.dev subdomains are intermittently flagged after mass reporting. A total blocklist count is not provided, but community threat feeds have not yet escalated this instance due to low detection rates. As of the latest intelligence, gamium-world.pages.dev remains active and poses a moderate but evolving risk. Immediate remediation includes blocking the domain at DNS and network levels, flagging the IP 188.114.96.3, and disabling access via corporate firewalls using SNI filtering. Users are strongly advised to avoid connecting wallets or entering credentials on any Pages.dev subdomain with gaming-themed lures. Security teams should monitor for new hashes or infrastructure pivots, especially if this domain escalates in blocklists or VT detections. Remaining risk is currently assessed as active but contained, pending further forensic correlation.