tokens-dapp[.]pages[.]dev

This domain, tokens-dapp.pages.dev, is actively engaged in cryptocurrency wallet credential theft, a form of phishing designed to harvest private keys or recovery phrases from decentralized application users. The infrastructure mimics legitimate token or decentralized finance (DeFi) platforms, likely using social engineering tactics such as fake airdrop claims, wallet upgrades, or token swaps to trick victims into entering sensitive credentials. The domain’s design and naming convention suggest a focus on users of blockchain-based applications, where the loss of credentials can result in immediate and irreversible asset theft. Analysis indicates the domain is hosted through Cloudflare, Inc. (AS13335) and resolves to the IP address 188.114.96.3, located in the United States. Its SSL certificate is issued by Google Trust Services (WE1), a common feature among both legitimate and malicious sites. Despite its active status, the domain has not been flagged by any of the 95 security engines on VirusTotal, though it appears on one security blocklist. The lack of widespread detection suggests either recent deployment or evasion techniques, such as rapid domain rotation or obfuscation of malicious payloads. Users who have interacted with tokens-dapp.pages.dev should immediately revoke any connected wallet permissions and transfer assets to a new, secure wallet. It is critical to check browser extensions and connected applications for unauthorized access, as phishing sites often deploy scripts to extract session tokens or stored credentials. If credentials were entered, assume they are compromised and avoid reusing them. Monitor transaction histories for unauthorized activity and report the domain to relevant security teams or blocklist providers to aid in broader mitigation efforts.