sko-connect[.]pages[.]dev

This domain, sko-connect.pages.dev, is identified as a crypto drainer scam targeting users through deceptive reward-based offers. The page title, 'Get rewarded for the internet you don’t use,' suggests an attempt to lure victims with false incentives, a common tactic in cryptocurrency theft operations. Analysis indicates the domain is designed to execute unauthorized transactions by tricking users into connecting their wallets, likely through malicious smart contracts or signature requests. No legitimate brand association has been confirmed, but the infrastructure mimics promotional campaigns to lower user vigilance. Infrastructure analysis reveals the following technical indicators: the domain is hosted on Cloudflare’s network (AS13335) and resolves to IP address 172.66.47.109. It was registered on March 20, 2025, through Cloudflare, Inc., and currently holds a VirusTotal detection score of 1/95. The domain appears on four security blocklists, including PhishDestroy and ScamSniffer, and is actively blocked by MetaMask and SEAL. The SSL certificate is issued by Google Trust Services (WE1), a common feature in both legitimate and malicious domains leveraging Cloudflare’s services. No Google Safe Browsing (GSB) flags were reported at the time of analysis. As of the latest assessment, sko-connect.pages.dev remains active and continues to pose a high risk to users. The domain’s infrastructure, including its Cloudflare hosting and recent registration, aligns with patterns observed in short-lived crypto drainer campaigns. Users are advised to avoid interacting with the site, revoke any connected wallet permissions, and verify transaction requests through trusted interfaces. Given the domain’s presence on multiple blocklists and its confirmed malicious activity, organizations should update filtering rules to prevent access. The remaining risk is elevated due to the domain’s persistence and the irreversible nature of cryptocurrency theft.