vote-teaprotocol-com[.]pages[.]dev

This domain, vote-teaprotocol-com.pages.dev, is currently active and operating as a crypto drainer scheme targeting open-source software contributors. The page impersonates a legitimate rewards program with the title 'Earn rewards for your open-source software contributions,' attempting to deceive developers into connecting cryptocurrency wallets to malicious smart contracts. Analysis indicates this is not a generic phishing attempt but a specialized attack designed to drain digital assets from victims under the guise of compensation for contributions. Infrastructure analysis reveals the domain is hosted on Cloudflare infrastructure, resolving to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services, providing a false sense of security. As of the latest scan, the domain has not been flagged by any of the 95 vendors on VirusTotal, indicating either recent deployment or effective evasion techniques. Technologies detected include HSTS, Google Tag Manager, and HTTP/3, suggesting a professionally configured platform designed to mimic legitimate reward portals. The registrar is Cloudflare, Inc., which aligns with the hosting provider, a common pattern in phishing infrastructure to maintain operational control. Current status remains active, with no signs of takedown or disruption. The risk level is classified as high due to the combination of zero detection on VirusTotal, active deployment, and direct targeting of cryptocurrency wallets. Organizations and individuals are advised to block the domain at the network level and add the IP 188.114.97.3 to firewall deny lists. Developers should be cautioned against connecting wallets to any platform offering unsolicited rewards, particularly those hosted on pages.dev subdomains. Monitoring for similar patterns—such as domains using 'tea protocol' or 'OSS rewards' themes—is recommended to preemptively identify related threats.