jaxs[.]pages[.]dev

PhishDestroy identifies jaxs.pages.dev as an active Ethereum drainer phishing domain currently categorized as under investigation. This domain leverages Cloudflare’s Pages service to host a sophisticated cryptocurrency drainer kit designed to siphon funds from unsuspecting victims under the guise of legitimate transactions. No specific brand is mimicked in this campaign, indicating a generalized but targeted approach likely relying on social engineering tactics such as fake airdrops or fraudulent giveaways to lure victims. The drainer kit is equipped with evasion techniques to bypass initial detection layers, posing a significant risk to users engaging with untrusted links.

This domain was flagged by PhishDestroy with a VirusTotal detection score of 0 out of 95 engines as of the latest scan, indicating zero proactive blocking by major security vendors. Registered through Cloudflare, Inc., jaxs.pages.dev resolves to IP address 188.114.97.3, allocated within Cloudflare’s infrastructure. The domain operates with a Google Trust Services SSL certificate, enhancing its legitimacy appearance. Additional technical indicators reveal no current status on Google Safe Browsing (GSB) blocklists, reflecting a blind spot in widely deployed filtering systems.

As of today, jaxs.pages.dev remains active with an 'under investigation' status by PhishDestroy. Immediate response actions include continuous monitoring for domain takedown or IP deprecation by Cloudflare, and updating blocklists across partner networks. However, the domain’s reliance on legitimate infrastructure such as Cloudflare Pages and Google Trust Services highlights the evolving challenge in proactive phishing prevention. Users are strongly advised to avoid interacting with any links from jaxs.pages.dev and to verify the authenticity of cryptocurrency-related websites through official channels. Remaining risk is classified as active with potential for escalation should the drainer kit expand its targeting scope.