# lichen-network-wallet.pages.dev — SUSPICIOUS

> lichen-network-wallet.pages.dev is a crypto drainer site with 0/95 VirusTotal detections. Avoid interacting with this active threat.

## Summary
PhishDestroy identifies lichen-network-wallet.pages.dev as a live crypto drainer posing as a wallet service. When users connect their cryptocurrency wallets to this fraudulent site, malicious JavaScript silently approves token transfers to attacker-controlled addresses, draining funds without consent. This is not a theoretical risk—it is an active wallet-draining operation currently hosted on Cloudflare Pages and monitored by security researchers to track its infrastructure and redirections.


This domain was flagged by PhishDestroy after VirusTotal scans returned 0 out of 95 antivirus engines detecting the threat as of the seed 8f46f7 analysis window. The site resolves to IP 172.66.44.204 (Cloudflare infrastructure) and uses a valid Let’s Encrypt SSL certificate to appear legitimate. Registered through Cloudflare, Inc., the domain uses a Pages.dev subdomain commonly abused for short-lived phishing and drainer campaigns, suggesting rapid deployment and evasion tactics.


If you visited this site, do not connect any cryptocurrency wallet or sign any transaction prompts. Disconnect your device from the internet immediately and revoke any unauthorized wallet approvals using blockchain explorers or tools like Etherscan’s Token Approval Checker or Revoke.cash. Report the domain to your antivirus provider and consider rotating wallet addresses and private keys if exposure occurred. Monitor your on-chain activity closely and report suspicious transactions to local cybercrime units.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registrar: Cloudflare, Inc.
- IP: 172.66.44.204

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/f1b36f8e-cf7f-4f5d-8c7a-ed483b0296ca
- PhishDestroy: https://phishdestroy.io/domain/lichen-network-wallet.pages.dev/
- LLM endpoint: https://phishdestroy.io/domain/lichen-network-wallet.pages.dev/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/lichen-network-wallet.pages.dev/
Last updated: 2026-03-22