darpraddar[.]pages[.]dev

PhishDestroy identifies domain darpraddar.pages.dev as an active brand impersonation threat targeting DappRadar users. This domain mimics the legitimate DappRadar brand to deceive visitors into disclosing sensitive wallet credentials or approving malicious token approvals. While no drainer kit artifacts were detected in initial scans, the domain’s structure suggests a high likelihood of deploying a fake wallet drainer upon interaction, consistent with recent phishing campaigns against DeFi platforms. The threat actor leverages Cloudflare Pages hosting to obfuscate infrastructure and evade detection, relying on the reputation of Cloudflare’s hosting service to bypass early-stage security filters. This domain resolves to IP 172.66.44.166 via Cloudflare, Inc., with a VirusTotal detection score of 0/95 as of the latest scan. The domain was registered through Cloudflare’s Pages platform, which enables rapid deployment of spoofed domains under legitimate hosting infrastructure. The SSL certificate is issued by Google Trust Services, further enhancing the domain’s perceived legitimacy. As of this report, the domain remains unflagged on major blocklists, including Google Safe Browsing (GSB status: clean), indicating a window of opportunity for the threat actor to operate undetected. The absence of detections suggests either a newly deployed campaign or sophisticated evasion techniques to avoid signature-based detection systems. The current status of this domain is active and under investigation, with no confirmed takedown actions as of this report. Users are advised to avoid interacting with darpraddar.pages.dev and verify all DappRadar-related links by cross-referencing the official domain (dappradar.com) via trusted sources. Security teams should monitor this domain for changes in infrastructure or behavior, particularly as it may be added to blocklists retroactively. Remaining risk is assessed as moderate due to the domain’s use of credible hosting and SSL infrastructure, which increases the likelihood of successful deception. Immediate action includes updating threat intelligence feeds to include this domain and educating users on verifying domain authenticity before entering sensitive information or approving transactions.