matmochains[.]pages[.]dev

This domain, matmochains.pages.dev, is identified as a credential harvesting phishing site specifically targeting users of cryptocurrency wallets. Analysis indicates the site masquerades as a legitimate blockchain service interface, employing social engineering tactics to deceive victims into entering private keys, recovery phrases, or wallet passwords. The infrastructure is designed to capture sensitive authentication details, which are then transmitted to attacker-controlled servers for unauthorized access and asset theft. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered through Cloudflare, Inc. on March 29, 2026, and resolves to the IP address 172.66.44.149. Detection metrics show that 15 out of 95 security vendors on VirusTotal have flagged the domain as malicious. Additionally, the domain appears on one security blocklist, and independent trust assessments assign scores of 1/100 and 0/100, reflecting near-universal consensus on its malicious nature. The SSL certificate is issued by Google Trust Services, providing a false sense of security to potential victims. Users who have accessed matmochains.pages.dev or entered credentials on the site should immediately take corrective actions. All exposed wallet credentials, including private keys and recovery phrases, must be considered compromised and should be revoked. Affected users are advised to transfer remaining assets to a new, secure wallet using a clean device. System scans using updated detection tools are recommended to identify potential secondary infections. If financial loss has occurred, incident reports should be filed with relevant financial and cybersecurity authorities for further investigation.