lmwxcvkmwcv[.]pages[.]dev

This domain, lmwxcvkmwcv.pages.dev, is flagged as a high-risk phishing site impersonating Phantom, a cryptocurrency wallet service. Registered on February 10, 2026, through Cloudflare, Inc., the domain resolves to IP address 172.66.44.90 and is hosted on infrastructure utilizing a Google Trust Services SSL certificate. Analysis indicates the page title explicitly references a 'Phantom Wallet Exploit' under the guise of a 'Revoke Approvals' service, a common tactic to deceive users into disclosing wallet credentials or approving malicious transactions. The domain appears on one security blocklist and is detected by one of 95 security vendors on VirusTotal, suggesting limited but confirmed malicious activity. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as a threat. At present, the domain remains active and unmitigated. Defenders should prioritize blocking this domain at the DNS or proxy level, particularly in environments where cryptocurrency-related services are accessed. Additional monitoring of related infrastructure (e.g., 172.66.44.90) may reveal further malicious domains leveraging the same hosting provider. The exact phishing kit or payload is not yet analyzed, but the combination of brand impersonation and wallet exploit themes aligns with known crypto-drainer campaigns. No evidence of takedown or sinkholing has been observed as of July 12, 2026.