bitkeep-wallet-public[.]pages[.]dev

This domain is flagged as an active crypto drainer phishing site targeting cryptocurrency wallet users. Analysis indicates the infrastructure is designed to mimic legitimate wallet services, specifically BitKeep Wallet, to execute unauthorized transactions and drain digital assets from connected wallets. The threat type is classified as a crypto drainer, a high-risk category due to its direct financial impact on victims. Infrastructure analysis reveals the domain bitkeep-wallet-public.pages.dev was registered through Cloudflare Pages and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to appear legitimate. The domain was created on June 09, 2026, and currently shows 0/95 detections on VirusTotal, indicating it has not yet been widely flagged by security engines. It appears on 1 security blocklist, suggesting early-stage detection by at least one threat intelligence source. The page title, 'BitKeep Wallet - Secure Multi-Chain Crypto Wallet,' is an exact replica of the legitimate service, increasing the likelihood of successful social engineering. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (188.114.97.3) at the network perimeter. Organizations and individuals should monitor for connections to this domain, particularly from systems or users involved in cryptocurrency transactions. Users who may have interacted with the site should revoke any wallet permissions granted to unknown or suspicious domains and transfer assets to a new wallet address. Additionally, security teams should review logs for outbound connections to the domain or IP and investigate any associated transactions for signs of unauthorized activity. Dissemination of this indicator to endpoint protection systems and threat intelligence feeds is recommended to prevent further exploitation.