dapwebbsyn[.]pages[.]dev

PhishDestroy identifies dapwebbsyn.pages.dev as an active crypto drainer impersonating MetaMask, posing severe risk to cryptocurrency users. This domain employs a classic phishing tactic by mimicking the legitimate MetaMask interface to trick visitors into connecting their wallets and unwittingly authorizing fraudulent transactions. Once connected, the drainer silently drains token balances, NFTs, and other digital assets. Victims often realize the theft only after funds vanish from their wallets, leaving little recourse for recovery. This campaign specifically targets users seeking Web3 connectivity or wallet management tools, exploiting their trust in recognized names within the ecosystem. This domain was flagged by 15 of 95 VirusTotal security vendors and has been added to multiple blocklists including MetaMask and SEAL. It was registered through Cloudflare, Inc., with the SSL certificate issued by Google Trust Services, giving it a false appearance of legitimacy. The domain resolved to IP 172.66.47.72 and was created to serve as a social engineering front, as confirmed by Google Safe Browsing’s SOCIAL_ENGINEERING classification. The combination of a free Pages.dev subdomain and HTTPS configuration suggests an attempt to bypass traditional security measures that rely on domain reputation or lack of encryption. If you visited dapwebbsyn.pages.dev, immediately disconnect your wallet from any dApps or Web3 interfaces it may have accessed. Revoke any wallet permissions it might have obtained—use tools like revoke.cash or wallet’s built-in permission manager. Transfer any remaining funds to a new, secure wallet using a different seed phrase. Scan your device for malware using reputable antivirus software, as this site may have installed keyloggers or trojans. Finally, report the domain and any suspicious transactions to MetaMask support and relevant blockchain security platforms to help block future attacks using this infrastructure.