phanpay[.]io

This domain, phanpay.io, operates as a confirmed crypto wallet drainer specifically impersonating MetaMask, a widely used cryptocurrency wallet service. The site employs deceptive login interfaces and transaction prompts designed to trick users into authorizing malicious smart contracts, resulting in unauthorized fund transfers from their wallets. The infrastructure mimics legitimate MetaMask authentication flows, increasing the likelihood of successful social engineering attacks against cryptocurrency holders. Analysis indicates phanpay.io was registered on May 10, 2026, through Dynadot Inc, a registrar frequently associated with high-risk domains. The domain resolves to the IP address 94.183.168.68 and is currently detected by 12 out of 95 security vendors on VirusTotal. It appears on four distinct security blocklists, including those maintained by MetaMask and other cybersecurity entities. The site was hosted on Nginx servers and utilized PHP, technologies commonly leveraged in phishing infrastructure for dynamic content delivery and obfuscation. The page title, Miran Mail Paneli, suggests an attempt to disguise the malicious nature of the site under a seemingly benign administrative interface. Users who interacted with phanpay.io should immediately revoke any suspicious wallet authorizations and transfer remaining funds to a new, secure wallet. All connected devices should undergo a thorough malware scan to detect potential secondary infections. It is recommended to monitor transaction histories for unauthorized activity and report the incident to relevant blockchain security platforms. Given the domain's high-risk classification and offline status, affected users should remain vigilant for follow-up phishing attempts via email or social engineering vectors.