dcent-webapp[.]com

This domain impersonates a legitimate hardware cryptocurrency wallet provider, presenting itself as an official platform for secure crypto storage and transactions. Analysis indicates the site likely functions as a credential harvester or crypto drainer, designed to trick users into entering sensitive wallet recovery phrases, private keys, or login credentials. Such schemes often lead to immediate fund theft from connected wallets, with attackers exploiting the irreversible nature of blockchain transactions to siphon assets before victims detect the compromise. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on December 18, 2025, through NameSilo, LLC, an uncommon choice for legitimate hardware wallet providers. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, while it appears on 3 security blocklists and is referenced in 2 AlienVault OTX threat intelligence pulses. The site resolves to IP address 88.223.85.90 and uses a Let's Encrypt SSL certificate, a common tactic to appear legitimate while masking fraudulent intent. Technologies detected include LiteSpeed and Hostinger, which are frequently observed in phishing infrastructure due to their low-cost hosting options. Users who visited dcent-webapp.com should immediately revoke any wallet connections or authorizations granted to the site. If recovery phrases, private keys, or passwords were entered, the affected wallet should be considered compromised, and all funds should be transferred to a new, secure wallet using a different device. Monitor transaction histories for unauthorized activity and report the incident to relevant blockchain explorers or security teams. To prevent future exposure, verify domain authenticity through official channels before interacting with any wallet-related sites, and use hardware-based security solutions to mitigate credential theft risks.