main-dapp-bfs[.]pages[.]dev

This domain, main-dapp-bfs.pages.dev, is currently flagged as an active high-risk phishing resource specializing in decentralized finance (DeFi) wallet credential theft. Analysis indicates the site mimics legitimate wallet interfaces to harvest seed phrases, private keys, and authentication credentials from cryptocurrency users. The domain remains operational and exhibits characteristics consistent with targeted phishing campaigns against blockchain-based financial services. Infrastructure analysis reveals the domain was registered on November 10, 2024, through Cloudflare, Inc., and resolves to the IP address 188.114.96.3, associated with AS13335 (Cloudflare, Inc.) in the United States. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for malicious domains leveraging reputable certificate authorities to appear legitimate. Detection metrics show the domain is flagged by 12 of 95 security vendors on VirusTotal, while appearing on two distinct security blocklists: PhishDestroy and ScamSniffer. These indicators confirm the domain's malicious classification despite its recent registration date. Current status assessment confirms main-dapp-bfs.pages.dev remains active and accessible, posing an ongoing threat to users of decentralized applications. Organizations and individuals are advised to implement immediate network-level blocking of the domain and its resolving IP address. Endpoint protection systems should be updated to include this indicator of compromise, while users should be alerted to verify all wallet connection prompts through official channels only. Given the domain's association with credential theft targeting financial assets, incident response teams should monitor for unauthorized transaction attempts linked to this infrastructure.