pippinlovereward[.]pages[.]dev

This domain, pippinlovereward.pages.dev, is flagged as a generic phishing site targeting decentralized finance (DeFi) users. Analysis indicates the page impersonates SynthDeFi, a legitimate blockchain project, under the guise of "Synthesizing the Future of DApps." The site likely functions as a credential harvester or wallet drainer, designed to trick users into connecting cryptocurrency wallets or entering sensitive recovery phrases. No specific drainer kit signature has been attributed at this time, but the thematic focus aligns with known DeFi phishing campaigns observed in early 2026. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on February 12, 2026, and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, a common practice among phishing sites to appear legitimate. Detection metrics show 12 out of 95 security vendors on VirusTotal flagging the domain as malicious. It appears on two independent security blocklists and is actively blocked by at least two major threat intelligence feeds. The domain has a trust score of 0/100, reinforcing its classification as a high-confidence phishing threat. As of the latest scan, pippinlovereward.pages.dev has been taken offline, likely in response to detection and blocking by security providers. However, the underlying infrastructure remains a potential risk. Adversaries may re-deploy the phishing kit under a new subdomain or domain using the same registrar and hosting provider. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include the domain and associated IP, and conduct retroactive log analysis to identify potential exposure within their networks.