egld-mainnet[.]pages[.]dev

PhishDestroy identifies egld-mainnet.pages.dev as a confirmed generic phishing site targeting MultiversX ($EGLD) users. The page title, “Upgrade $EGLD CONTRACT and Claim rewards | MultiversX,” is a classic social engineering lure designed to trick victims into connecting their wallets and approving malicious transactions that drain EGLD tokens. This type of phishing typically uses a wallet drainer kit to automatically transfer funds once the victim signs a transaction.

Technical indicators further confirm the malicious nature of this domain. VirusTotal reports 2 of 95 security vendors flagging the domain, and it appears on one security blocklist. The domain was created on September 29, 2024, and is registered through Cloudflare, Inc. It resolves to IP address 172.66.44.174, and its SSL certificate is issued by Google Trust Services (WE1). Notably, Google Safe Browsing does not currently list this domain, which may allow it to bypass some browser warnings.

As of the time of analysis, the phishing site remains active and operational. PhishDestroy recommends that all MultiversX users avoid interacting with this domain or any unsolicited prompts to “upgrade contracts” or “claim rewards.” Users who have already connected their wallets should immediately revoke any token approvals using a revoke tool like Revoke.cash and transfer remaining funds to a new, secure wallet. Always verify official communication channels and domain names for MultiversX (multiversx.com) before performing any sensitive actions.