nvrk-reward[.]pages[.]dev

PhishDestroy identifies the domain nvrk-reward.pages.dev as an active crypto drainer campaign. The page mimics a reward platform to deceive users into connecting cryptocurrency wallets and authorizing malicious token transfers. No specific drainer kit signatures (e.g., MetaSploit, Inferno Drainer) were observed at time of analysis, indicating the payload may be dynamically served or obfuscated to evade static detection.

Technical indicators for nvrk-reward.pages.dev include: VirusTotal detection score of 0/95 engines (unflagged as of UTC 2024-06-06), registered through Cloudflare, Inc., resolving to IP 188.114.97.3 via Cloudflare CDN, and secured using a Google Trust Services SSL certificate. The domain was created on 2024-05-14 via Cloudflare Registrar and has not been flagged by Google Safe Browsing (GSB) or listed on blocklists such as PhishTank or OpenPhish at the time of assessment. No reverse DNS or WHOIS privacy is in use.

This domain remains active and unblocked across major browsers and security platforms. Immediate action is required: users should block 188.114.97.3 and nvrk-reward.pages.dev at the network and endpoint levels. Organizations are advised to push IOCs to SIEMs and EDRs via IOC sharing platforms such as MISP. Remaining risk is high due to absence of vendor detections and reliance on user vigilance to avoid wallet connections. Monitor for new variants under the same seed c52184, particularly on related Cloudflare Pages instances.