saferate-hedera-webapp[.]pages[.]dev

This domain is flagged as a high-risk phishing threat targeting users of Hedera-based cryptocurrency wallets. Analysis indicates it operates under the guise of a legitimate webapp interface, likely designed to harvest credentials or private keys from unsuspecting victims attempting to access their digital assets. The specific threat type is a fake wallet interface, a common vector for cryptocurrency theft and unauthorized fund transfers. Infrastructure analysis reveals the following concrete indicators: the domain was created on February 21, 2026, and is registered through Cloudflare, Inc. It resolves to the IP address 188.114.97.3 and appears on one security blocklist. The page title, SafeRate Hedera Webapp, mimics legitimate wallet services to deceive users. The SSL certificate is issued by Google Trust Services (WE1), which, while valid, does not mitigate the malicious intent. VirusTotal detection shows 1 out of 95 security vendors flagging this domain as malicious, a low but notable signal given the domain's recent creation and targeted nature. To mitigate risks associated with this threat, users should immediately cease interaction with saferate-hedera-webapp.pages.dev. Cryptocurrency holders are advised to verify wallet interfaces by cross-referencing official project documentation or community-verified sources. Browser-based security extensions that block known phishing domains should be enabled, and network-level filtering can be implemented to deny requests to this IP address. If credentials or private keys were entered on this site, users must transfer assets to a new wallet and revoke any compromised access immediately. Organizations should update internal blocklists to include this domain and its associated IP to prevent employee exposure.