lucky-box-cm[.]pages[.]dev

PhishDestroy identifies lucky-box-cm.pages.dev as an active crypto drainer scam site mimicking a giveaway to steal cryptocurrency from victims. This domain was flagged under the generic_phishing threat type with a current risk level marked under_investigation. The threat operates by presenting fake promotional offers that trick users into connecting their crypto wallets, resulting in unauthorized fund transfers to attacker-controlled addresses. Unlike credential phishing, this attack bypasses login screens entirely by exploiting wallet signatures, making it particularly dangerous for users familiar with traditional phishing red flags. lucky-box-cm.pages.dev resolves to IP address 172.66.44.85 and is registered through Cloudflare, Inc., with an SSL certificate issued by Google Trust Services. As of seed 740820, VirusTotal shows 0 detections out of 95 scanners, indicating this domain has not yet been widely flagged by security tools despite its active status. The use of Cloudflare's infrastructure provides anonymity benefits to threat actors, while the Google Trust Services certificate adds a false sense of legitimacy to unsuspecting users. The domain's pages.dev subdomain suggests it was created recently, exploiting free tiers of legitimate services to host malicious content. Users affected by this scam typically experience immediate financial losses with no recovery options, as blockchain transactions are irreversible. The attack vector differs from traditional phishing by requiring victims to actively sign malicious transactions rather than entering credentials. To mitigate risk, users should never connect wallets to unfamiliar websites, verify domains through PhishDestroy before interaction, and use hardware wallets for sensitive transactions. Security researchers should monitor this domain for changes in infrastructure or distribution methods while reporting any new IOCs to threat intelligence platforms. The current lack of detection emphasizes the need for behavioral analysis rather than relying solely on signature-based detection systems.