dappfinance[.]pages[.]dev

This domain, dappfinance.pages.dev, is identified as a high-risk phishing site targeting cryptocurrency wallet users. The page impersonates a legitimate multi-chain wallet service, specifically mimicking the branding and interface of a self-custody wallet for DeFi, NFTs, and Web3. The site employs social engineering tactics to deceive users into entering sensitive credentials, likely leading to unauthorized access or asset theft. No explicit drainer kit signatures were detected, but the infrastructure aligns with credential-harvesting campaigns targeting decentralized finance platforms. Analysis indicates the domain was registered through Cloudflare, Inc. on October 01, 2024, and resolves to the IP address 188.114.96.3. Security vendors on VirusTotal flagged the domain at a detection rate of 16/95, while Google Safe Browsing classifies it under the SOCIAL_ENGINEERING category. The domain appears on three independent security blocklists and is actively blocked by at least three additional threat intelligence feeds. The SSL certificate is issued by Google Trust Services, and the site employs HSTS, Cloudflare CDN, and HTTP/3 protocols, suggesting an attempt to appear legitimate while obfuscating malicious intent. As of the latest verification, dappfinance.pages.dev has been taken offline, likely due to enforcement actions by the hosting provider or domain registrar. However, the infrastructure remains a residual risk, as threat actors may re-deploy the phishing kit under a new domain or subdomain. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.