web3-appconnect[.]pages[.]dev

This domain, web3-appconnect.pages.dev, is identified as a crypto wallet drainer phishing operation targeting users of decentralized applications. Analysis indicates the site was designed to mimic legitimate Web3 authentication portals, tricking victims into connecting wallets to malicious smart contracts that execute unauthorized token transfers. No specific brand impersonation was confirmed, but the use of generic Web3 terminology and Cloudflare Pages infrastructure aligns with known drainer kit deployment patterns observed in prior campaigns. Infrastructure analysis reveals the domain was created on April 03, 2026, and registered through Cloudflare, Inc. It resolves to the IP address 188.114.96.3, geolocated to Canada under Cloudflare’s network. The domain is flagged by 18 out of 95 security vendors on VirusTotal, with detections spanning phishing, malicious URL, and crypto-related fraud categories. It appears on two security blocklists and is associated with an SSL certificate issued by Google Trust Services (WE1). Google Safe Browsing status was not explicitly provided, but the domain’s inclusion in multiple threat intelligence feeds corroborates its malicious classification. As of the latest verification, web3-appconnect.pages.dev has been taken offline, likely following abuse reports or automated takedown mechanisms. While the domain no longer resolves, residual risk persists due to potential redirects, cached pages, or re-registration under similar naming conventions. Users who interacted with the site prior to takedown should immediately revoke wallet permissions, audit connected dApps, and monitor transaction histories for unauthorized activity. Organizations are advised to update blocklists with this domain and its associated IP to prevent future exposure.