zeitgeist-6k5[.]pages[.]dev

This domain, zeitgeist-6k5.pages.dev, is currently flagged as an active crypto drainer site designed to compromise digital asset wallets and siphon cryptocurrency. Analysis indicates the infrastructure is operational and targeting users through deceptive transaction prompts or wallet connection requests. No legitimate brand affiliation has been identified, suggesting this is a standalone malicious operation rather than brand impersonation. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Cloudflare, Inc., and resolves to the IP address 172.66.44.166, located in Canada. Security vendor assessments show 6 of 95 VirusTotal engines have flagged the domain as malicious. The domain appears on three distinct security blocklists and is actively blocked by multiple wallet protection systems. Creation date anomalies and Cloudflare's hosting suggest an attempt to leverage reputable infrastructure to evade detection while maintaining operational persistence. Current status remains active, with no signs of takedown or mitigation. Users are strongly advised to block the domain at the network level and avoid any interaction with zeitgeist-6k5.pages.dev or associated subdomains. Wallet holders should verify all transaction requests independently and use hardware-based signing for sensitive operations. Organizations should update internal blocklists to include this domain and monitor for related indicators of compromise, particularly those involving wallet drainer scripts or unexpected contract interactions.