mainetnode[.]pages[.]dev

PhishDestroy identifies mainetnode.pages.dev as an active cryptocurrency drainer site currently engaged in credential harvesting and asset exfiltration through social engineering tactics targeting crypto investors. This domain, resolved via Cloudflare Pages, masquerades as a legitimate node interface while deploying malicious JavaScript to drain victim wallets upon authentication. No specific brand or drainer kit signature has been publicly released for attribution at this stage, indicating a likely custom implementation designed to evade signature-based detection systems.

This domain was flagged by Google Safe Browsing under the SOCIAL_ENGINEERING category and analyzed by 95 security vendors via VirusTotal, with 14 independent detections confirming malicious intent. It resolves to IP address 188.114.96.3 and is registered through Cloudflare, Inc., leveraging Google Trust Services for SSL certificate validation. The domain is hosted on Cloudflare Pages and has been active since at least mid-2024 based on passive DNS correlation, demonstrating rapid deployment common among opportunistic crypto drainers.

As of the latest intelligence cycle, mainetnode.pages.dev remains actively accessible and continues to pose a HIGH risk to users interacting with cryptocurrency platforms or wallet interfaces. Immediate blocklisting is advised across security solutions, browsers, and endpoint protection platforms. Users are strongly urged to avoid accessing this domain and to verify all wallet and node-related URLs through official channels before entering credentials or transferring assets. While current detection coverage is at 14.7% across the security community, the domain’s flexible hosting infrastructure through Cloudflare Pages enables rapid evasion and re-deployment, requiring continuous monitoring and proactive threat hunting to mitigate ongoing risks.