rewardrwd[.]pages[.]dev

This domain, rewardrwd.pages.dev, operates as a fraudulent crypto reward platform designed to drain digital wallets. Analysis indicates the site presents fake reward offers to trick users into connecting their cryptocurrency wallets, enabling unauthorized transactions that transfer funds to attacker-controlled addresses. The threat primarily targets users through deceptive advertisements or social media links, exploiting urgency and false incentives to bypass security awareness. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on March 29, 2026, through Cloudflare, Inc., an unusual registrar for legitimate reward platforms. VirusTotal detections show 10 out of 95 security vendors flagging the domain, with additional blocking by four independent security blocklists. The site resolves to IP address 188.114.96.3 and employs Cloudflare hosting with HSTS enforcement, likely to appear legitimate while masking its true origin. The SSL certificate issued by Google Trust Services further obscures detection by blending with trusted infrastructure. Users who visited rewardrwd.pages.dev should immediately revoke any wallet connections made to the site. Check all connected applications in wallet settings and remove any unknown or suspicious entries. Review recent transactions for unauthorized activity, particularly those involving unfamiliar addresses. If funds were transferred, report the incident to relevant blockchain explorers and law enforcement cybercrime units. Enable enhanced security measures such as hardware wallet isolation and transaction pre-approval requirements to prevent future compromise. Monitor accounts for subsequent phishing attempts, as attackers may reuse collected data for follow-up attacks.