search-phntm-wlt[.]pages[.]dev

The domain search-phntm-wlt.pages.dev is flagged as a credential phishing site, specifically targeting MetaMask users. It is currently offline, but it was detected by PhishDestroy on the same day it was created, March 9, 2026. This domain is flagged by 3 out of 94 vendors on VirusTotal and appears on 3 public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL.

Hosted by Cloudflare, Inc. in the United States, the domain leverages Google's SSL certification, which may lend it an appearance of legitimacy to unsuspecting users. The hosting IP, 172.66.44.136, is associated with Cloudflare's infrastructure, indicating a common tactic of using reputable services to mask malicious intent. The domain's platform risk score is 68 out of 100, suggesting a significant threat level.

Phishing domains like search-phntm-wlt.pages.dev exploit the critical window between domain registration and antivirus database updates. PhishDestroy's early detection pipeline captures these threats before they proliferate widely, providing an essential layer of protection. The site's takedown mitigates immediate risks, but its initial presence underscores the ongoing threat of credential phishing attacks targeting cryptocurrency users.