wallet-ldjirlive-access[.]pages[.]dev

PhishDestroy identifies wallet-ldjirlive-access.pages.dev as an active crypto drainer site under seed bc5439. This domain poses a high risk to cryptocurrency users by masquerading as a legitimate wallet access portal to steal funds. The threat actor leverages Cloudflare Pages to host a deceptive interface designed to trick victims into connecting their wallets, triggering unauthorized transactions that drain assets without consent. Given the domain’s recent activation and lack of detection, immediate caution is advised for all users engaging in crypto transactions.

This domain resolves to IP 172.66.44.216 and is registered through Cloudflare, Inc. The SSL certificate is issued by Google Trust Services, which may lend false legitimacy to the site. VirusTotal currently shows 9 out of 95 security engines detecting the domain as malicious, indicating it remains under the radar of most automated defenses. The domain is hosted on Cloudflare Pages, a service often abused by threat actors to rapidly deploy and rotate malicious infrastructure. While the exact creation date is not provided, the active status and absence of detections suggest recent deployment, likely within the last 30 days. No known inclusion on blocklists or threat intelligence feeds has been confirmed at this time.

The primary risk associated with wallet-ldjirlive-access.pages.dev is crypto drainer malware, specifically targeting users attempting to access or manage cryptocurrency wallets. The threat actor behind this campaign employs social engineering tactics, such as mimicking legitimate wallet access pages, to deceive victims into connecting their wallets via Web3 interfaces. Once connected, the drainer automatically executes unauthorized transactions, transferring funds to wallets controlled by the attacker. Users are strongly advised to verify the authenticity of any wallet access page by checking the URL, ensuring the use of HTTPS, and cross-referencing the domain with official sources. Additionally, users should enable hardware wallet signing, use transaction simulation tools, and implement wallet-level security features like transaction approval limits. If exposure is suspected, immediately disconnect the wallet, revoke any unauthorized approvals, and transfer remaining assets to a secure, offline wallet. Report the domain to relevant authorities and threat intelligence platforms to aid in takedown efforts.