math-is-fun[.]pages[.]dev

math-is-fun.pages.dev was flagged by PhishDestroy for hosting a crypto-draining phishing site designed to trick visitors into approving malicious wallet transactions. The domain mimics a legitimate educational portal to lure users into connecting their wallets under false pretenses, aiming to drain assets via deceptive smart-contract approvals. The page presents itself as an interactive math game but silently loads scripts that request wallet connections and token approvals, a common tactic among crypto-draining operations. PhishDestroy’s analysis reveals this domain was registered on February 22, 2024, through Cloudflare, Inc., and resolved to 172.66.47.127 at the time of detection. Notably, VirusTotal currently shows 0 detections across 95 security engines, indicating evasive behavior typical of emerging threats. The domain leverages a Let’s Encrypt SSL certificate to appear legitimate, while the Cloudflare Pages hosting infrastructure provides anonymity layers that obscure the true operators. The low detection count suggests early-stage deployment, with active campaigns likely targeting social media or gaming communities under the guise of free educational tools. If you visited math-is-fun.pages.dev, disconnect your wallet immediately using your wallet’s provider interface and revoke any token approvals via tools like revoke.cash or Etherscan. Do not approve any pending transactions or reconnect your wallet until you’ve verified the legitimacy of the site through independent sources. Report the domain to your antivirus vendor and block it at your network level to prevent further exposure. Share this advisory with peers who may have been targeted, as crypto-draining phishing campaigns often reuse infrastructure across multiple victims.