# appfrax-finance.pages.dev — SUSPICIOUS

> Fraudulent Frax Finance staking site on appfrax-finance.pages.dev. Steals crypto via fake staking rewards. Blocked by 4/95 VirusTotal vendors. Avoid and report.

## Summary
PhishDestroy identifies appfrax-finance.pages.dev as a live cryptocurrency-themed phishing domain impersonating Frax Finance’s staking platform to harvest user credentials and funds. The page, titled 'Frax Finance - Staking Overview,' mimics the legitimate Frax Finance staking interface to deceive visitors into connecting wallets or entering private keys under the guise of earning rewards. This domain leverages Cloudflare’s Pages.dev infrastructure to appear legitimate while hosting a spoofed staking portal designed to trick users into surrendering control of their assets.  This domain poses a high risk due to multiple red flags confirmed by independent analysis. VirusTotal reports 4 out of 95 security vendors flag this domain as malicious, indicating limited but present detection across industry tools. Registered through Cloudflare, Inc., the domain resolves to IP 188.114.96.3 and is served via a Google Trust Services SSL certificate, further enhancing its deceptive legitimacy. The page content directly mimics Frax Finance’s staking interface, a common tactic in crypto phishing campaigns targeting yield farmers and DeFi users. While the exact registration date is unavailable, the site remains active and continues to serve the fraudulent content.  Users who visited appfrax-finance.pages.dev should immediately disconnect any connected wallets, revoke any potentially exposed permissions via blockchain explorers or wallet interfaces, and scan their devices for malware. Do not enter any private keys, seed phrases, or login credentials. Report the domain to your security provider and relevant platforms (e.g., WalletConnect, browser extensions) to help block further access. Always verify the URL and use bookmarked links to legitimate sites—never follow links from unsolicited messages or ads. If staking activity is required, access it only through the official Frax Finance website.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: alive (HTTP ?)
- Page title: Frax Finance - Staking Overview

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 188.114.96.3

## Detection Status
- VirusTotal: 4 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/7348e48b-2593-4f99-92c7-c873b0ad5061
- PhishDestroy: https://phishdestroy.io/domain/appfrax-finance.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/appfrax-finance.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/appfrax-finance.pages.dev/
Last updated: 2026-04-11