rewards-lava[.]pages[.]dev

The domain rewards-lava.pages.dev is currently flagged as an active credential theft operation targeting cryptocurrency users under the guise of Lava Points rewards. Analysis indicates this infrastructure is designed to harvest login credentials, private keys, or wallet recovery phrases through deceptive prompts mimicking legitimate crypto reward platforms. The domain remains operational as of the latest verification, posing a direct risk to users interacting with its content. Infrastructure analysis reveals the domain was registered on March 28, 2026, through Cloudflare Pages, a platform frequently leveraged for rapid deployment of phishing pages. It resolves to the IP address 172.66.44.83, a Cloudflare-hosted endpoint with no prior association with legitimate Lava Points or Magma-branded services. The SSL certificate, issued by Google Trust Services (WE1), provides no inherent trust validation, as phishing domains commonly utilize free or automated certificate authorities. Detection metrics show the domain is flagged by 3 of 95 security vendors on VirusTotal, while appearing on 2 independent security blocklists. The page title, 'Lava Points | Magma,' directly impersonates a cryptocurrency rewards program, a tactic consistent with credential theft campaigns targeting digital asset holders. Current status confirms the domain remains active, with no takedown or mitigation measures observed. Users are advised to treat any interaction with rewards-lava.pages.dev as malicious. Network-level blocking of the IP 172.66.44.83 and domain-based filtering are recommended for organizations. Individuals who may have entered credentials or sensitive information should immediately revoke access to associated crypto wallets, rotate passwords, and monitor for unauthorized transactions. Verification of crypto reward offers should be conducted exclusively through official channels, with scrutiny applied to domains lacking verifiable ownership or established reputation.