mainnetsportal[.]pages[.]dev

This domain, mainnetsportal.pages.dev, is actively engaged in cryptocurrency wallet phishing, targeting users of decentralized finance (DeFi) platforms. The site masquerades as a legitimate MainNet project portal, likely designed to harvest wallet credentials, private keys, or seed phrases through fraudulent login interfaces or fake token airdrop claims. The use of a Cloudflare-hosted subdomain and a generic project name suggests an attempt to exploit trust in emerging blockchain networks while evading detection through ephemeral infrastructure. Analysis indicates the domain was registered on March 24, 2026, through Cloudflare, Inc., and currently resolves to the IP address 188.114.96.3, geolocated to a Cloudflare data center in Canada. The SSL certificate, issued by Google Trust Services (WE1), provides a veneer of legitimacy, though it is automatically provisioned and not indicative of trustworthiness. Security vendors have flagged the domain in 4 out of 95 VirusTotal scans, and it appears on at least one public blocklist, specifically PhishDestroy. The page title, 'MainNet Project,' reinforces the deception by mimicking legitimate blockchain project branding. Users who have visited mainnetsportal.pages.dev or interacted with its content should assume their credentials or private keys may be compromised. Immediate actions include revoking any wallet connections, transferring assets to a new wallet, and scanning the affected device for malware. Browser-based wallet extensions should be removed and reinstalled, and all stored passwords or recovery phrases should be rotated. Network-level monitoring for connections to 188.114.96.3 or related Cloudflare-hosted subdomains is recommended to detect ongoing exposure. Given the domain's active status and high-risk classification, continued vigilance is advised for any communications or links referencing 'MainNet Project' or similar nomenclature.