ks1-wallet[.]pages[.]dev

PhishDestroy flags ks1-wallet.pages.dev as an active crypto drainer infrastructure leveraging Pages.dev to host malicious JavaScript designed to siphon funds from unwitting cryptocurrency wallet users.

This domain was flagged following a 0/95 VirusTotal detection, indicating no current AV coverage, low community scrutiny, and limited historical telemetry. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and operates under a Google Trust Services SSL certificate—suggesting reliance on legitimate infrastructure to bypass security controls. The infrastructure age, registration date, and blocklist inclusion status remain under investigation, but the absence of detections signals a potential zero-day or early-stage campaign that could escalate quickly.

Crypto drainers like this one typically employ obfuscated JavaScript to monitor wallet activity and initiate unauthorized transactions upon detecting fund transfers. Users who interact with the domain risk immediate asset loss without recourse. Mitigation requires immediate action: isolate any interactions involving ks1-wallet.pages.dev, block the IP 188.114.96.3 at the firewall, and cross-reference any received crypto wallet links against PhishDestroy’s verified database prior to engagement. Ensure wallet extensions and browsers are updated to prevent exploitation of known vulnerabilities.