en-live-io[.]pages[.]dev

PhishDestroy identifies en-live-io.pages.dev as a live crypto drainer website designed to trick visitors into connecting cryptocurrency wallets under the guise of a legitimate livestream service. The page leverages Cloudflare Pages infrastructure to present a convincing fake interface that prompts wallet connections, enabling malicious actors to drain funds without user consent. According to telemetry, this domain resolves to IP 172.66.44.202 and is served under a Google Trust Services SSL certificate, increasing its appearance of legitimacy to untrained users. This domain was flagged by 2 out of 95 security vendors on VirusTotal, indicating limited but present detection coverage. Cloudflare, Inc. registered the domain as part of its Pages service, commonly used for static site hosting, which reduces transparency and makes takedowns slower. The site is part of an ongoing campaign targeting cryptocurrency users during high-traffic events such as live broadcasts or gaming streams. If you visited en-live-io.pages.dev or connected a wallet, immediately revoke all permissions using tools like revoke.cash or Rabby Wallet’s revoke feature. Disconnect the wallet from any unknown applications, transfer remaining assets to a clean wallet if possible, and scan for malware. Report the domain to your wallet provider and relevant platforms like Google Safe Browsing. Never reconnect the wallet to this or similar domains. Stay vigilant—legitimate streaming platforms do not require wallet connections.