Detected obfuscated Web3 wallet drainer payload hosted on abused free developer platform (`pages.dev`) with urgent prize/airdrop social engineering intent.
IDN homograph, obfuscation and PSL abuse
Logo match and phishing impersonation
Credential harvesting forms and sandbox risks
27-category scam taxonomy and lure urgency
Bulletproof ASN, GeoIP and PTR reputation
Certificate chain, HSTS, CSP and hardening
Beacon failures and malicious trackers
Zero-hour domain age and registrar risk
Rogue ad scripts and deceptive trackers
Version-matched OSV.dev CVEs and DAST
Extracted inline script contains obfuscated `signTransaction` / `setApprovalForAll` calls communicating with a known drainer C2 relay.
Subdomain hosted on free static hosting infrastructure commonly abused for ephemeral crypto drainer lures.