duoiudf-dsdds-chy[.]pages[.]dev

This domain is actively impersonating Pendle, a decentralized finance protocol, to deploy crypto drainer malware. Visitors are tricked into connecting wallets to fraudulent smart contracts, resulting in unauthorized token transfers and permanent asset loss. The site displays a German placeholder page ('Nur einen Moment…') but likely redirects or loads malicious content dynamically to evade detection. Crypto drainers are particularly dangerous as they bypass traditional authentication and execute transactions directly from compromised wallets. Analysis indicates the domain was registered on July 29, 2024, through Cloudflare, Inc., and resolves to 188.114.97.3 (AS13335). Despite 0 detections in VirusTotal’s 95-engine scan, it appears on three security blocklists: PhishDestroy, ScamSniffer, and Enkrypt. The SSL certificate is issued by Google Trust Services (WE1), a common tactic to appear legitimate. Infrastructure patterns suggest the attacker is leveraging Cloudflare Pages for hosting, which provides free, disposable subdomains often abused for phishing campaigns. If you visited duoiudf-dsdds-chy.pages.dev, immediately disconnect any connected wallets from the site and revoke permissions via a blockchain explorer. Check transaction history for unauthorized activity and transfer remaining assets to a new, secure wallet. Monitor for signs of compromise, such as unexpected token approvals or balance changes. Report the domain to your wallet provider and relevant threat intelligence platforms to prevent further exploitation. Avoid interacting with any site impersonating Pendle or other DeFi protocols unless verified through official channels.