dapp-reward[.]pages[.]dev

This domain, dapp-reward.pages.dev, is identified as a high-risk phishing site impersonating a cryptocurrency protocol under the name 'ordialsynprotocol'. Analysis indicates it functions as a wallet drainer, designed to harvest private keys, seed phrases, and sensitive credentials from unsuspecting users attempting to interact with decentralized applications. The site mimics legitimate Ordinals or synthetic asset protocols, likely exploiting recent trends in Bitcoin layer-2 solutions to deceive victims into connecting compromised wallets. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is registered through Cloudflare, Inc., with a creation date of July 03, 2024, and resolves to the IPv6 address 2606:4700:3030::6815:5001, hosted on Cloudflare’s network (AS13335). It is flagged by 14 out of 95 security vendors on VirusTotal, and appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious Cloudflare-hosted sites. No Google Safe Browsing (GSB) detection was explicitly noted, but the domain remains actively blocked by multiple threat intelligence feeds. As of the latest assessment, dapp-reward.pages.dev remains active and continues to pose a significant risk to users. The site is still serving malicious content, and no takedown or suspension has been observed. Users are strongly advised to avoid interaction with the domain, and wallet software should enforce hard blocks on any connection attempts. Organizations are recommended to update internal blocklists with the domain and associated IP, and monitor for related infrastructure reuse under similar naming conventions. The combination of recent registration, Cloudflare hosting, and confirmed drainer functionality underscores the need for heightened vigilance in decentralized finance environments.