app-en-us-drft-protocol[.]pages[.]dev

This domain is flagged as a high-risk brand impersonation targeting users of Drift, a decentralized exchange (DEX) platform. The site presents itself as "Drift Protocol – A Secure and Transparent DEX for Advanced Traders," mimicking the legitimate Drift brand to deceive visitors into disclosing sensitive information such as wallet credentials, private keys, or other authentication details. The impersonation extends to visual and textual elements designed to replicate the official Drift interface, increasing the likelihood of successful social engineering attacks against cryptocurrency traders and investors. Analysis indicates the domain app-en-us-drft-protocol.pages.dev was registered through Cloudflare, Inc. on October 15, 2025, and resolves to the IP address 172.66.47.155, located in Canada under Cloudflare’s infrastructure. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains. Detection metrics reveal limited but concerning visibility: the domain appears on one security blocklist and is flagged by 1 out of 95 security vendors on VirusTotal. The low detection rate suggests either recent deployment or evasion techniques, though the domain remains actively accessible. Users who have visited app-en-us-drft-protocol.pages.dev or interacted with its content should assume potential exposure. Immediate actions include revoking any connected wallet authorizations, rotating credentials for associated accounts, and scanning local devices for malware. Cryptocurrency transactions initiated through this domain should be reviewed for unauthorized activity, and affected parties are advised to report the incident to relevant security teams or abuse contacts. Monitoring for further phishing attempts using similar domain patterns (e.g., drift-protocol, drft-en-us) is recommended, as this campaign may represent a broader impersonation effort.