polkadotjs-apps[.]web[.]app

This domain is flagged as a high-risk crypto drainer specifically designed to impersonate the legitimate Polkadot/Substrate Portal interface. Analysis indicates the site is engineered to harvest wallet credentials and drain cryptocurrency assets from unsuspecting users under the guise of the official Polkadot ecosystem. The specific threat type involves a fake login portal that mimics the authentic Polkadot.js interface, tricking victims into entering sensitive wallet information or approving malicious transactions. Infrastructure analysis reveals the domain polkadotjs-apps.web.app is registered through Google LLC, leveraging Google's hosting infrastructure to lend false credibility. The domain resolves to IP address 199.36.158.100, located in the United States under AS54113 (Fastly, Inc.). Detection metrics show 2 out of 95 security vendors on VirusTotal flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Google Trust Services (WR4), further obscuring its malicious nature through legitimate encryption. The page title explicitly mimics the official portal, displaying 'Polkadot/Substrate Portal' to enhance deception. Mitigation against this crypto drainer requires immediate action from both users and security teams. Users should verify domain authenticity by cross-referencing with official Polkadot documentation and never enter wallet credentials on untrusted sites. Security teams are advised to implement network-level blocking of the domain and associated IP address 199.36.158.100. Wallet providers should monitor for transaction approvals originating from this domain and alert users to revoke any suspicious permissions. Given the domain's use of legitimate hosting infrastructure, additional scrutiny of Google-hosted subdomains with cryptocurrency-related naming patterns is recommended for proactive detection of similar threats.