# lejer-live-start.pages.dev — SUSPICIOUS > lejer-live-start.pages.dev identified as a crypto drainer domain with 0/95 VirusTotal detections. Block immediately to prevent fund theft. ## Summary PhishDestroy identifies lejer-live-start.pages.dev as an active crypto drainer posing as a legitimate service. The domain is currently unflagged but operates with malicious intent to deceive users into surrendering cryptocurrency assets. This domain is served through Cloudflare, Inc. as the registrar, resolving to IP 172.66.47.95 with a Google Trust Services SSL certificate. VirusTotal analysis shows 0 detections out of 95 vendors, while the domain remains absent from major blocklists. The infrastructure leverages the Pages.dev platform, a reputable service that has been abused to host malicious payloads. Given the confirmed malicious functionality as a crypto drainer, immediate action is required. Organizations and users should block lejer-live-start.pages.dev at the network perimeter and DNS level. Avoid accessing the domain and report it to threat intelligence platforms to enhance detection coverage. Monitor transactions for any outgoing transfers to wallet addresses associated with this domain. ## Threat Details - Verdict: SUSPICIOUS - Site status: unknown (HTTP ?) ## Domain Intelligence - Registrar: Cloudflare, Inc. - IP: 172.66.47.95 ## Detection Status - VirusTotal: 0 vendors flagged - Google Safe Browsing: clean - Blocklists: 0 hits ## Evidence - Cloudflare Radar: https://radar.cloudflare.com/scan/29419610-d6a2-42cb-bf32-6ea9de083742 - PhishDestroy: https://phishdestroy.io/domain/lejer-live-start.pages.dev/ - LLM endpoint: https://phishdestroy.io/domain/lejer-live-start.pages.dev/llm.txt ## If You Visited This Site 1. Change any passwords you may have entered 2. Enable 2FA on all related accounts 3. Monitor your accounts for unauthorized activity 4. Report to: FBI IC3, Europol, local authorities --- Report by PhishDestroy | https://phishdestroy.io/domain/lejer-live-start.pages.dev/ Last updated: 2026-03-30