radar-dapp[.]dev

This domain, radar-dapp[.]dev, poses a direct threat as a crypto drainer designed to siphon digital assets from connected cryptocurrency wallets. Analysis indicates the site impersonates the legitimate 1inch decentralized exchange platform, luring users with promises of free airdrops or token distributions. The infrastructure abuses Wallet Connect protocols, a common vector for unauthorized transaction approvals, allowing attackers to drain funds once a user connects their wallet. The threat is particularly insidious because it exploits trust in established brands and relies on social engineering rather than direct malware deployment. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain is flagged by 12 out of 95 security vendors on VirusTotal, with detections spanning phishing, fraud, and malicious wallet activity. It appears on three independent security blocklists, further corroborating its malicious nature. The domain resolves to the IPv6 address 2a06:98c1:3121::3, hosted on Cloudflare infrastructure (AS13335), a common pattern among phishing sites leveraging content delivery networks to obscure their origin. Registration details show the domain was created through arin, though no SSL certificate was present, an unusual omission for legitimate financial or DeFi platforms. The page title, 'Airdrops - Get free crypto tokens | DappRadar,' mimics the branding of DappRadar, a well-known analytics platform, to enhance credibility. Users who visited radar-dapp[.]dev or connected a wallet to the site should take immediate action to mitigate risk. First, revoke any active wallet connections or session approvals granted to the domain through Wallet Connect or similar services. This can typically be done via the wallet’s connected apps or dApp permissions settings. Next, transfer all assets from the compromised wallet to a new, secure wallet with a fresh seed phrase, as attackers may retain access even after revocation. Monitor transaction history for any unauthorized transfers and report the incident to relevant blockchain explorers or security communities for further tracking. Given the high-risk nature of this threat, affected users should also consider reporting the domain to their wallet provider or local cybersecurity authorities to aid in broader mitigation efforts.