galaxyswap[.]pages[.]dev

PhishDestroy identifies galaxyswap.pages.dev as an ACTIVE crypto drainer campaign distributing malicious payloads to cryptocurrency users. This phishing domain is configured to target blockchain wallet connections, specifically designed to drain digital assets upon wallet interaction. The malicious infrastructure has been observed in the wild and is currently under investigation for broader campaign patterns. Users should avoid direct interaction and verify all wallet connections to this domain immediately.

This domain resolves to IP 188.114.96.3 and operates with a Let's Encrypt SSL certificate, registered through Cloudflare Inc. VirusTotal currently shows 0 detections out of 95 scanning engines as of the latest intelligence update. The domain uses Cloudflare’s services for anonymity and anti-takedown protection, leveraging the pages.dev subdomain to appear as legitimate development hosting. No known blocklist inclusion has been recorded at this time, and trust scores remain uncalculated due to the recent discovery. The technical setup indicates a low-profile but high-risk deployment designed to evade early detection mechanisms.

Crypto drainer domains like galaxyswap.pages.dev present severe financial risk upon wallet connection. Users should NEVER authorize wallet connections to unknown domains, even if the site appears to load properly. Always verify domains through PhishDestroy’s wallet verification tool before interacting with any blockchain-related interface. If connection has already occurred, revoke wallet permissions immediately via your wallet provider’s security settings and transfer remaining assets to a cold wallet. Monitor transaction history for any unauthorized transfers and report suspicious activity to your wallet provider and PhishDestroy for further analysis.