paal-stakings[.]pages[.]dev

This domain, paal-stakings.pages.dev, operates as a phishing portal designed to harvest cryptocurrency wallet credentials through fake staking interfaces. Analysis indicates the site mimics legitimate staking platforms, presenting users with fraudulent login forms that capture private keys and recovery phrases. The infrastructure is engineered to deceive users into believing they are interacting with a genuine staking service, increasing the likelihood of credential theft. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain was registered on June 23, 2024, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.55, associated with Cloudflare's network. Security vendors have flagged this domain, with 8 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on three security blocklists, including PhishDestroy, ScamSniffer, and Enkrypt, further corroborating its fraudulent nature. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security to potential victims. Users who visited paal-stakings.pages.dev should immediately revoke any permissions granted to the site in their cryptocurrency wallets. All credentials entered on the site should be considered compromised, necessitating the transfer of funds to a new wallet with a fresh seed phrase. Affected users should also monitor their accounts for unauthorized transactions and report the incident to relevant security teams. Given the domain's current offline status, continued vigilance is advised, as threat actors may redeploy similar infrastructure under different domains.