login-coineldgr[.]pages[.]dev

PhishDestroy has flagged login-coineldgr.pages.dev as an active credential-phishing domain under investigation. This Pages.dev subdomain is actively distributing a crypto drainer disguised as a login portal, aiming to harvest wallet credentials and private keys under the guise of an Elrond (eGLD) authentication page. The threat combines brand impersonation (Elrond) with direct credential theft, creating a high-risk vector for cryptocurrency users seeking to access their wallets or exchanges.

This domain was registered through Cloudflare, Inc., and currently resolves to IP address 188.114.97.3. It holds a valid SSL certificate issued by Google Trust Services, which may help it evade traditional browser warnings. As of the latest scan, VirusTotal shows 0 detections out of 95 engines, indicating it remains undetected by most antivirus platforms. The domain is hosted on Cloudflare Pages, leveraging a trusted infrastructure to appear legitimate. No known blocklists currently flag it, but its recent creation and zero detections suggest it is newly operational.

To mitigate risk, avoid accessing any crypto login portals via this domain or similar Pages.dev subdomains. Users should always navigate directly to official websites (e.g., elrond.com or major exchange login pages) and verify SSL certificates and domain spellings. Enable hardware wallet authentication and multi-factor authentication (MFA) wherever possible. Report this domain to your antivirus provider and, if you’ve previously entered credentials, revoke wallet access immediately and transfer funds to a new, secure wallet. Monitor transaction activity closely and report suspicious transfers to relevant blockchain explorers.