skins-btx[.]pages[.]dev

PhishDestroy identifies skins-btx.pages.dev as an active Bitcoin drainer scam domain under investigation for phishing. This Cloudflare Workers-hosted site leverages the skins-btx.pages.dev subdomain to impersonate legitimate gaming or crypto platforms, tricking users into connecting cryptocurrency wallets and initiating unauthorized transactions that drain funds directly to attacker-controlled addresses. The scam kit is designed to exploit trust in popular gaming terminology (skins) while targeting crypto users seeking quick profits or in-game assets. No known brand impersonation has been confirmed at this stage, but the domain’s structure suggests it may mimic skins marketplaces or crypto airdrop sites to maximize credibility. skins-btx.pages.dev resolves to IP 172.66.47.73 with a valid Let's Encrypt SSL certificate, adding superficial legitimacy. VirusTotal currently shows 0 detections out of 95 scanners, indicating zero antivirus or security service coverage at time of analysis. The domain is registered through Cloudflare, Inc., which provides both DNS and proxy services, obscuring the true origin and hosting infrastructure. As of this report, exact creation date is unverified via public WHOIS due to Cloudflare’s privacy protection, but the domain remains active and accessible. Google Safe Browsing (GSB) has not yet flagged this domain, and no third-party blocklists (e.g., PhishTank, OpenPhish) have included it in their feeds. These technical characteristics suggest a recently deployed, minimally detected campaign likely in early operational stages. The domain is currently active with a confirmed threat status. Immediate action is recommended for users, security teams, and browser vendors: block access to skins-btx.pages.dev at network and endpoint levels, and report the domain to threat intelligence platforms and browser blocklists. While the risk is classified as “under_investigation,” the use of a drainer kit and zero detection rate elevates the threat of real-world compromise. Remaining risk includes potential expansion of the campaign to evade detection, use of traffic redirection to other malicious domains, or pivoting to brand impersonation as trust in the domain grows. Continuous monitoring via automated feeds and user reports is essential to contain this threat before significant financial damage occurs. Users interacting with crypto or gaming platforms should verify URLs via official channels and avoid unsolicited wallet connection requests.