smartsprocurement[.]pages[.]dev

This domain hosts a malicious page impersonating a cross-chain protocol interface and is assessed as a credential and crypto asset theft vector. The content is designed to resemble a legitimate Multichain-related application in order to deceive users into connecting wallets or entering authentication data. Once interaction occurs, the page may facilitate unauthorized transaction signing, wallet draining, or credential capture, enabling direct financial loss and account compromise. The infrastructure pattern is consistent with fake dApp frontends used in phishing campaigns targeting Web3 users.

Technical intelligence confirms multiple independent risk signals. VirusTotal reports 16/95 security vendors flagging the domain as malicious. The domain was created on June 14, 2024 and is currently active. It is registered through Cloudflare Pages infrastructure. The page is served with SSL issued by Google Trust Services / WE1 and resolves to IP 172.66.46.213. Additional reputation signals include listing on 5 security blocklists, along with detection by Google Safe Browsing as phishing. These overlapping indicators suggest coordinated abuse of trusted hosting and certificate infrastructure to increase credibility while masking malicious intent.

Users who have interacted with this domain should assume potential compromise of wallet keys or session tokens. Immediate actions include disconnecting any linked wallets, revoking token approvals, and transferring remaining assets to a secure wallet with new seed phrases. Any credentials entered should be treated as exposed and rotated immediately. Systems used to access the site should be scanned for malware or browser-based injection artifacts. Network defenders should block the domain and associated IP 172.66.46.213, and monitor for repeated connections. Given the domain’s continued activity and multi-source detection, ongoing exposure risk remains high and proactive blocking at DNS and browser extension level is recommended.