mmm-3mf[.]pages[.]dev

PhishDestroy identifies mmm-3mf.pages.dev as a crypto-draining phishing site leveraging the stakefish brand to trick users into delegating tokens to malicious validators. The domain uses a highly specific URL path structure (mmm-3mf) registered under Cloudflare Pages, allowing rapid deployment and evasion of traditional takedown measures. No drainer kit artifacts are publicly available yet, but the page title (“Stake your crypto with a reliable validator | stakefish”) and branding alignment suggest a direct impersonation strategy targeting stakefish’s legitimate validator service.

Technical indicators confirm elevated risk: VirusTotal shows 0/95 detections as of the current scan, indicating undetected malware or cloaking behavior. The site resolves to IP 172.66.44.236, hosted by Cloudflare, with an SSL certificate issued by Google Trust Services. Domain registration details remain obscured due to Cloudflare’s privacy protection, but the pages.dev subdomain namespace suggests recent creation under Cloudflare Pages, a common tactic for short-lived phishing portals. Google Safe Browsing (GSB) status is currently unflagged, and this site is not listed on major threat intelligence blocklists, leaving users vulnerable as threat actors iterate quickly.

Current status is active and evolving, with the domain still serving phishing content targeting crypto users. Response actions should include immediate flagging to GSB, takedown requests to Cloudflare Pages, and network-level blocking of IP 172.66.44.236. Remaining risk is high due to low detection rates and the use of legitimate infrastructure, making real-time monitoring and user education critical. Users should avoid interacting with any stakefish-themed staking links outside of the official site (stake.fish) and verify all URLs before connecting wallets.