tophat-one[.]pages[.]dev

The domain tophat-one.pages.dev is a phishing site engaged in brand impersonation targeting users of berachain, a known blockchain platform. It was designed to deceive visitors into connecting wallets via a fraudulent 'wallet_connect_phish' scheme, potentially exposing them to asset theft. No drainer kit was identified, but the site operated as a credential and wallet-connection phish. As of analysis, tophat-one.pages.dev has been taken offline.

Technical indicators confirm the elevated risk. The domain was flagged by 1 of 95 VirusTotal security vendors, including Fortinet, and appeared on 5 security blocklists such as PhishDestroy, ScamSniffer, and Polkadot. Registered through Cloudflare, Inc. on December 26, 2024, it resolved to IP address 172.66.44.96, hosted on Cloudflare's US infrastructure (AS13335). The SSL certificate was issued by Google Trust Services (WE1), and the observed page title was 'Top Hat Agents'. Gridinsoft assigned a trust score of 0/100, while Scamadviser rated it 6/100. Technologies detected included HSTS, Cloudflare, and HTTP/3, and the site returned an HTTP 403 status when accessed.

Victims who interacted with tophat-one.pages.dev should immediately revoke any token approvals granted to unknown contracts and transfer funds to a new wallet. If credentials were entered, change passwords on the legitimate berachain platform and enable two-factor authentication. Monitor accounts for unauthorized transactions and report the phishing domain to platforms like Google Safe Browsing, PhishTank, or the impersonated brand's security team for further action.