live-led-gr[.]pages[.]dev

PhishDestroy identifies live-led-gr.pages.dev as an active crypto drainer infrastructure leveraging Cloudflare Pages to harvest wallet credentials and drain digital assets. The domain masquerades as a legitimate crypto service, exploiting trust in Cloudflare’s infrastructure to evade early detection. Behavioral analysis reveals redirection patterns typical of crypto drainer toolkits, including staged payload delivery via obfuscated JavaScript hosted on the platform. This domain represents a credible threat to cryptocurrency users seeking secure platforms. This domain resolves to 188.114.97.3 and operates under a Google Trust Services SSL certificate, increasing legitimacy perception among non-technical users. Registration occurs through Cloudflare, Inc., which complicates takedown due to Cloudflare Pages hosting. VirusTotal currently shows 0 detections across 95 engines, indicating zero signature-based detection despite active phishing behavior. The domain’s creation and deployment occurred recently, with no presence on major blocklists at the time of analysis. Trust scores remain artificially elevated due to Cloudflare integration and SSL certification. Mitigation against crypto drainers requires immediate network and endpoint blocking of live-led-gr.pages.dev and its resolving IP 188.114.97.3. Users should avoid clicking links from unsolicited crypto-related communications and verify destination URLs through official channels. Organizations should deploy DNS filtering rules blocking *.pages.dev domains with crypto-related keywords. Wallet software should integrate transaction simulation and real-time risk scoring to detect drainer-induced transfers. Security teams should monitor for lateral movement if any device within the network interacts with this domain.