project-mainnet[.]pages[.]dev

PhishDestroy identifies project-mainnet.pages.dev as a high-risk crypto drainer impersonating a legitimate 'Projects-mainnet.xyz' domain. This page is designed to trick users into connecting cryptocurrency wallets or submitting credentials under the guise of a blockchain project interface. The threat actor leverages Cloudflare’s Pages service to host a convincing replica of a mainnet project portal, specifically targeting users seeking early access or token launches. Technical analysis confirms the presence of a drainer kit embedded in the page, which silently requests wallet connections and may execute unauthorized token transfers upon approval. This domain resolves to IP 188.114.97.3 and is registered through Cloudflare, Inc., which obscures the true registrant identity. The domain was created recently and currently holds a VirusTotal detection score of 1 out of 95 security vendors, indicating low but present malicious recognition. Google Safe Browsing has flagged the domain under the category 'SOCIAL_ENGINEERING', confirming deceptive intent. Additionally, the domain appears on 1 security blocklist and is blocked by ScamSniffer. Despite these warnings, the SSL certificate is issued by Google Trust Services, which may lend false legitimacy to users. The domain remains active and continues to serve malicious content. As of the latest assessment, project-mainnet.pages.dev remains active and poses an immediate risk to cryptocurrency users. PhishDestroy advises all users to avoid interacting with this domain, including wallet connections or data submissions. Block the domain at the network and DNS level, and report the URL to Google Safe Browsing and ScamSniffer. Remaining risk is high due to the active status and the potential for the drainer kit to evolve or spread across similar domains. Continuous monitoring and proactive threat intelligence sharing are recommended to prevent further exploitation.