dapp-dexfinance[.]pages[.]dev

This domain is flagged as an active crypto wallet drainer phishing site with elevated risk. Analysis indicates it specifically targets decentralized finance (DeFi) users through fraudulent decentralized application (dApp) interfaces, attempting to steal cryptocurrency wallet credentials and private keys via malicious smart contract interactions. Infrastructure analysis reveals the domain dapp-dexfinance.pages.dev was registered on May 31, 2024 through Cloudflare, Inc. and resolves to IP address 172.66.44.111 (AS13335, Cloudflare, Inc., US). The SSL certificate is issued by Google Trust Services (WE1). Security vendor detections show 10/95 flags on VirusTotal, with blocking implemented by at least two security providers: PhishDestroy and ScamSniffer. The domain appears on two security blocklists, and Cloudflare's own systems have marked it with the page title 'Suspected phishing site | Cloudflare'. Mitigation requires immediate action from both users and security teams. Users who interacted with this domain should revoke all connected dApp authorizations through their wallet settings, transfer remaining assets to a new wallet, and scan devices for malware. Security teams should add the domain and IP 172.66.44.111 to web filtering systems, monitor for related subdomains using the 'pages.dev' namespace, and implement blockchain transaction monitoring for addresses associated with this drainer. Given the domain's recent creation and Cloudflare hosting, additional related phishing domains may emerge using similar naming patterns.