manage-download-live[.]pages[.]dev

PhishDestroy analysis of manage-download-live.pages.dev reveals an active crypto drainer domain mimicking legitimate Google Pages hosting. This site leverages Cloudflare’s infrastructure and a Google Trust Services SSL certificate to appear credible, tricking users into connecting crypto wallets or downloading malicious payloads under the guise of file management tools. The domain resolves to IP 188.114.96.3, a known hosting node associated with malicious campaigns targeting cryptocurrency users through deceptive download pages. This domain was flagged with 7/95 detections on VirusTotal at time of analysis, indicating low signature-based detection despite clear malicious intent. Registered through Cloudflare, Inc., it uses a Google Trust Services SSL certificate to enhance legitimacy and evade browser warnings. While the exact creation date is unverified, the active status and recent network association suggest it is part of an ongoing campaign. Its low VT score highlights the need for behavior-based detection and proactive user vigilance, as traditional antivirus tools often lag behind emerging threats. If you visited manage-download-live.pages.dev or entered any wallet credentials, disconnect your wallet immediately using a clean device and revoke any unauthorized permissions via blockchain explorers or wallet interfaces. Do not interact further with the domain or related links. Report the site to PhishDestroy and your local cybersecurity authorities. Always verify download sources, use hardware wallets for sensitive transactions, and enable transaction simulation tools to detect anomalous outgoing transfers.