blockchaindefi[.]pages[.]dev

This domain, blockchaindefi.pages.dev, is confirmed to operate as a brand impersonation phishing site targeting users of the Across Protocol, a decentralized finance (DeFi) platform. The site presents itself under the page title 'DappsTools,' likely designed to deceive victims into interacting with fraudulent smart contracts, wallet drainers, or credential harvesting forms. Analysis indicates the infrastructure is specifically crafted to exploit trust in Across Protocol’s branding, potentially leading to unauthorized asset transfers or account takeovers in cryptocurrency wallets. Infrastructure analysis reveals multiple technical indicators supporting its malicious classification. The domain resolves to IP address 172.66.44.86, hosted on Cloudflare’s network (AS13335), and uses an SSL certificate issued by Google Trust Services (WE1). It was registered through Cloudflare, Inc. on March 05, 2026, an anomalous creation date suggesting domain spoofing or backdating. Security vendor detections on VirusTotal report 1/95 flagging the domain as malicious, while it appears on three independent security blocklists. The domain remains active and unmitigated at the time of this report. Users who have visited blockchaindefi.pages.dev or interacted with its content are advised to take immediate action. Disconnect any connected wallets from the site and revoke all active smart contract approvals using a blockchain explorer or security tool. Scan the device for malware, particularly browser extensions or keyloggers that may have captured sensitive data. Monitor wallet activity for unauthorized transactions and consider migrating funds to a new wallet if compromise is suspected. Report the domain to relevant security teams and avoid further interaction with any linked infrastructure.